Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Memory corruption when Adobe Shockwave Player parses .dir media file (duplicated LCSM entries in mmap record)
CVE-2010-4089


INTRODUCTION

Adobe Shockwave Player is the Adobe plugin to many different browsers to view rich-media content on the web including animations, interactive presentations, and online entertainment.

Adobe Shockwave Player does not properly parse .dir media file.  mmap records contains offsets and lengths of all other records.  One of such records is LCSM. It also contains references to other records. Duplicated LCSM entries causes memory corruption as shown in PoC (repro15.dir).

This problem was confirmed in the following versions of Adobe Shockwave Player and Windows, other versions may be also affected.

Shockwave Player version 11.5.8.612, Module IML32.dll on WinXP_PT SP3 Internet Explorer 8.0.6001.18702


CVSS Scoring System

The CVSS score is: 9
	Base Score: 10
	Temporal Score: 9
We used the following values to calculate the scores:
	Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
	Temporal score is: E:POC/RL:U/RC:C


TRIGGERING THE PROBLEM

To trigger the problem a PoC file (repro15.dir) is available to interested parties.


DETAILS


ModLoad: 03a20000 03a27000   C:\WINDOWS\system32\Adobe\Shockwave 11\xtras\CBrowser.x32
ModLoad: 03e10000 03e27000   C:\Documents and Settings\Rodrigo\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\TextAsset\Text Asset.x32
ModLoad: 048a0000 04989000   C:\Documents and Settings\Rodrigo\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\TextXtra\TextXtra.x32
ModLoad: 04430000 04475000   C:\Documents and Settings\Rodrigo\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\FontXtra\Font Xtra.x32
(1cc.b74): Access violation - code c0000005 (!!! second chance !!!)
eax=00000068 ebx=00000020 ecx=0162d550 edx=00000068 esi=0162d550 edi=0543386c
eip=69009f1f esp=0162d540 ebp=0543386c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
*** WARNING: Unable to verify checksum for C:\WINDOWS\system32\Adobe\Shockwave 11\IML32.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\Adobe\Shockwave 11\IML32.dll - 
IML32!Ordinal1113+0xf:
69009f1f 8b4804          mov     ecx,dword ptr [eax+4] ds:0023:0000006c=????????
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
0:008> !exploitable
Exploitability Classification: UNKNOWN
Recommended Bug Title: Data from Faulting Address controls Branch Selection starting at IML32!Ordinal1113+0x000000000000000f (Hash=0x1a537c3d.0x1a63313d)

The data from the faulting address is later used to determine whether or not a branch is taken.

Exploitation details sent to Adobe.



CREDITS

This vulnerability was discovered by Michael Golub and researched by Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team (VDT).