Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4089

[Rodrigo Branco <rbranco@xxxxxxxxxxxxxx>]

Dear List,

I'm writing on behalf of the Check Point Vulnerability Discovery Team to 
publish the following vulnerability.



Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Memory corruption when Adobe Shockwave Player parses .dir media file 
(duplicated LCSM entries in mmap record)
CVE-2010-4089


INTRODUCTION

Adobe Shockwave Player is the Adobe plugin to many different browsers to view 
rich-media content on the web including animations, interactive presentations, 
and online entertainment.

Adobe Shockwave Player does not properly parse .dir media file.  mmap records 
contains offsets and lengths of all other records.  One of such records is 
LCSM. It also contains references to other records. Duplicated LCSM entries 
causes memory corruption as shown in PoC (repro15.dir).

This problem was confirmed in the following versions of Adobe Shockwave Player 
and Windows, other versions may be also affected.

Shockwave Player version 11.5.8.612, Module IML32.dll on WinXP_PT SP3 Internet 
Explorer 8.0.6001.18702


CVSS Scoring System

The CVSS score is: 9
        Base Score: 10
        Temporal Score: 9
We used the following values to calculate the scores:
        Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
        Temporal score is: E:POC/RL:U/RC:C


TRIGGERING THE PROBLEM

To trigger the problem a PoC file (repro15.dir) is available to interested 
parties.


DETAILS


ModLoad: 03a20000 03a27000   C:\WINDOWS\system32\Adobe\Shockwave 
11\xtras\CBrowser.x32
ModLoad: 03e10000 03e27000   C:\Documents and Settings\Rodrigo\Application 
Data\Adobe\Shockwave Player 
11\xtras\download\AdobeSystemsIncorporated\TextAsset\Text Asset.x32
ModLoad: 048a0000 04989000   C:\Documents and Settings\Rodrigo\Application 
Data\Adobe\Shockwave Player 
11\xtras\download\AdobeSystemsIncorporated\TextXtra\TextXtra.x32
ModLoad: 04430000 04475000   C:\Documents and Settings\Rodrigo\Application 
Data\Adobe\Shockwave Player 
11\xtras\download\AdobeSystemsIncorporated\FontXtra\Font Xtra.x32
(1cc.b74): Access violation - code c0000005 (!!! second chance !!!)
eax=00000068 ebx=00000020 ecx=0162d550 edx=00000068 esi=0162d550 edi=0543386c
eip=69009f1f esp=0162d540 ebp=0543386c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
*** WARNING: Unable to verify checksum for C:\WINDOWS\system32\Adobe\Shockwave 
11\IML32.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for 
C:\WINDOWS\system32\Adobe\Shockwave 11\IML32.dll - 
IML32!Ordinal1113+0xf:
69009f1f 8b4804          mov     ecx,dword ptr [eax+4] ds:0023:0000006c=????????
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
0:008> !exploitable
Exploitability Classification: UNKNOWN
Recommended Bug Title: Data from Faulting Address controls Branch Selection 
starting at IML32!Ordinal1113+0x000000000000000f (Hash=0x1a537c3d.0x1a63313d)

The data from the faulting address is later used to determine whether or not a 
branch is taken.

Exploitation details sent to Adobe.



CREDITS

This vulnerability was discovered by Michael Golub and researched by Rodrigo 
Rubira Branco from Check Point Vulnerability Discovery Team (VDT).



Best Regards,
 
Rodrigo.
 
--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies