#######################################################################
Luigi Auriemma
Application: Microsoft Reader
http://www.microsoft.com/reader
Versions: <= 2.1.1.3143 (PC version)
the Origami 2.6.1.7169 version doesn't seem vulnerable
the non-PC versions have not been tested
Platforms: Windows, Windows Mobile, Tablet PC and UMPC devices
Bug: writing of NULL byte in arbitrary location
Date: 11 Apr 2011
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Microsoft Reader is a software needed to read and catalog the ebooks in
LIT format and the Audible audio books bought via internet, indeed the
homepage acts also as online store for these protected contents.
#######################################################################
======
2) Bug
======
Possibility to write a 0x00 byte in an arbitrary memory location.
From aud_file.dll (base address 5fff0000):
5FFF634A >|> 8D47 01 |LEA EAX,DWORD PTR DS:[EDI+1] ; size at offset 0xbd of the PoC
5FFF634D |. 50 |PUSH EAX
5FFF634E |. E8 2B470000 |CALL <JMP.&MSVCRT.??2@YAPAXI@Z> ; malloc
5FFF6353 |. 57 |PUSH EDI
5FFF6354 |. 50 |PUSH EAX
5FFF6355 |. FF75 08 |PUSH DWORD PTR SS:[EBP+8]
5FFF6358 |. 8945 F8 |MOV DWORD PTR SS:[EBP-8],EAX
5FFF635B |. E8 58460000 |CALL <JMP.&utils.?read_bytes@TypeIO@@SA> ; read
5FFF6360 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
5FFF6363 |. 83C4 10 |ADD ESP,10
5FFF6366 |. 802438 00 |AND BYTE PTR DS:[EAX+EDI],0 ; place the delimiter (all ok)
5FFF636A |. 807D FF 00 |CMP BYTE PTR SS:[EBP-1],0
5FFF636E |. 75 5B |JNZ SHORT aud_file.5FFF63CB
5FFF6370 |. 8D46 01 |LEA EAX,DWORD PTR DS:[ESI+1] ; size at offset 0xc1 of the PoC
5FFF6373 |. 50 |PUSH EAX
5FFF6374 |. E8 05470000 |CALL <JMP.&MSVCRT.??2@YAPAXI@Z> ; now malloc will return NULL
5FFF6379 |. 8BD8 |MOV EBX,EAX
5FFF637B |. 56 |PUSH ESI
5FFF637C |. 53 |PUSH EBX
5FFF637D |. FF75 08 |PUSH DWORD PTR SS:[EBP+8]
5FFF6380 |. E8 33460000 |CALL <JMP.&utils.?read_bytes@TypeIO@@SA> ; read
5FFF6385 |. 802433 00 |AND BYTE PTR DS:[EBX+ESI],0 ; exploitation
The first allocation must succeed to avoid problems during the
reading operations (like memcpy on 0x00000000).
Note that is not possible to exploit the visible integer overflow
caused by malloc(size + 1) because the function that reads the data
goes in endless loop, yeah bad.
The provided proof-of-concept first tries to allocate 0x44000000 bytes
and it should succeed without problems and then will try to allocate
the second size that MUST fail so that is possible to use the size
value as an arbitrary memory offset.
Modified bytes in the proof-of-concept:
000000BD 00 43 ; first size needed to steal memory to the next size
000000BE 00 FF
000000BF 00 FF
000000C0 0A FF
000000C1 00 61 ; second size, will try to write 0x00 at address 0x61616161
000000C2 00 61
000000C3 00 61
000000C4 16 61
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/msreader_5.zip
http://www.exploit-db.com/sploits/17164.zip
#######################################################################
======
4) Fix
======
No fix.
#######################################################################
