1. Advisory Information
Title: Adobe Director DIRAPI.DLL Memory Corruption Vulnerability
Advisory Id: CORE-2010-0405
Advisory URL: http://www.coresecurity.com/content/adobe-director
Date published: 2010-05-11
Date of last update: 2010-05-11
Vendors contacted: Adobe
Release mode: Coordinated release
2. Vulnerability Information
Class: Input validation error [CWE-20]
Impact: Denial of service
Remotely Exploitable: Yes (client-side)
Locally Exploitable: No
CVE Name: CVE-2010-0128
Bugtraq ID: N/A
3. Vulnerability Description
Adobe Director is prone to a memory corruption vulnerability due to an invalid write in dirapi.dll, when opening a malformed .dir file. This vulnerability could be used by a remote attacker to execute arbitrary code, by enticing the user of Adobe Director to open a specially crafted file.
4. Vulnerable packages
- Adobe Director 11.5
- Adobe Director 11 (Version: 11.0.0.426)
5. Non-vulnerable packages
- Adobe Director 11.5 (Version: 11.5.7.609)
6. Solutions and Workarounds
See the Adobe Security Bulletin [1] available at http://www.adobe.com/go/apsb10-12/.7. Credits
This vulnerability was discovered and researched by Nahuel Riva, from Core Security Technologies. Additional research was performed by Francisco Falcon. Publication was coordinated by Jorge Lucangeli Obes.
8. Technical Description
The vulnerability occurs at offset 0x68174813 of the dirapi.dll module of Adobe Director. Improper validation of the input data leads to a crash in the memory write instruction. This vulnerability could result in arbitrary code execution, although it was not verified.
The vulnerable module dirapi.dll takes the two-byte word at offset 0x41B82 of the .dir file, and uses it as a counter for a loop that performs memory writes. The value is used without being verified:
If the word at offset
0x41B82 has a sufficiently
high value, the application will loop more times than it should, thus corrupting
memory beyond limits.
Moreover, after reading said word, this value is sign-extended into a four-byte
dword, using the MOVSX instruction. If the most
significant bit of the word is set, the resulting dword will be of the form
0xFFFFXXXX, thus being a negative number if interpreted as a signed integer,
and a very large number if interpreted as an unsigned integer:
[+ full code]
When the dword is negative, the application does not enter the loop. However, the application does calculate a value using this dword, which can be controlled by the attacker.
[+ full code]
This value is stored and later, after stepping over the loop, added to a pointer. This pointer is subsequently used as a destination operand for a memory write instruction inside another loop, thus making the attacker able to partially control the destination instruction of the memory copy, allowing for memory corruption.
[+ full code]
9. Report Timeline
- 2010-04-14: Vendor contacted.
- 2010-04-14: Vendor requests PoC file.
- 2010-04-14: Core replies with the PoC file and the draft advisory.
- 2010-04-14: Adobe replies that will investigate the issue and sets a preliminary release date for June/July.
- 2010-04-15: Core agrees with the preliminary release date.
- 2010-04-28: Core requests an update on the situation, and asks whether Adobe was able to confirm if the bug is exploitable.
- 2010-04-28: Adobe replies that the issue was investigated and is scheduled to be fixed in the next release of Adobe Shockwave Player, planned for May; they did not carry out further exploitability research.
- 2010-04-28: Core requests a specific publication date for the fix.
- 2010-05-06: Adobe informs Core that the release date for the fix has been set to May 11th.
- 2010-05-07: Core asks Adobe if they want to provide the text for the "Solutions and Workarounds" section of the advisory.
- 2010-05-07: Adobe replies with the text for the "Solutions and Workarounds" section of the advisory.
- 2010-05-11: Advisory published.
- 2010-07-01: Additional research performed.
10. References
[1] Adobe Security Bulletin http://www.adobe.com/go/apsb10-12/.
11. About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://www.coresecurity.com/corelabs.
12. About Core Security Technologies
Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the most comprehensive product for performing enterprise security assurance testing. CORE IMPACT evaluates network, endpoint and end-user vulnerabilities and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core Security Technologies augments its leading technology solution with world-class security consulting services, including penetration testing and software security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com.
13. Disclaimer
The contents of this advisory are copyright (c) 2010 Core Security Technologies and (c) 2010 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) Licence: http://creativecommons.org/licenses/by-nc-sa/3.0/u
14. PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core