PDFCool Studio Buffer Overflow Vulnerability

Advisory ID Internal
CORE-2013-0828

1. Advisory Information

Title: PDFCool Studio Buffer Overflow Vulnerability
Advisory ID: CORE-2013-0828
Advisory URL: https://www.coresecurity.com/core-labs/advisories/pdfcool-studio-buffer-overflow-vulnerability
Date published: 2013-10-02
Date of last update: 2013-10-02
Vendors contacted: IconCool Software
Release mode: User release

2. Vulnerability Information

Class: Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2013-4986

3. Vulnerability Description

PDFCool Studio Suite [1], [2] is prone to a security vulnerability when processing PDF files. This vulnerability could be exploited by a remote attacker to execute arbitrary code on the target machine by enticing users to open a specially crafted PDF file (client-side attack).

4. Vulnerable Packages

  • PDFAX0722_IconCool.dll v7.22.1125.2121.
  • Other versions are probably affected too, but they were not checked.

5. Vendor Information, Solutions and Workarounds

There was no official answer from vendor after several attempts to report this vulnerability (see [Sec. 8]). As mitigation action, given that this is a client-side vulnerability, avoid to open untrusted PDF files. Contact vendor for further information.

6. Credits

This vulnerability was discovered and researched by Marcos Accossatto from CORE Exploit Writers Team.

7. Technical Description / Proof of Concept Code

Below is shown the result of opening the maliciously crafted PDF file [3] on Windows XP SP3 (EN):

$+A50C4 > 8B07 MOV EAX,DWORD PTR DS:[EDI] $+A50C6 > C740 14 1E000000 MOV DWORD PTR DS:[EAX+14],1E ; <== Exception - Tries to write to 909090A4 $+A50CD > 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] $+A50D1 > 8950 18 MOV DWORD PTR DS:[EAX+18],EDX $+A50D4 > 8BC7 MOV EAX,EDI $+A50D6 > 8B10 MOV EDX,DWORD PTR DS:[EAX]

At that time, the EAX register contains the first DWORD of our shellcode:

EAX 90909090 ECX 000007B4 EDX 0012E190 EBX 048757D1 ESP 0012DDFC EBP 0012E064 ESI 000002F0 EDI 0012DF88 EIP 044760C6 PDFAX0~1.044760C6 C 0 ES 0023 32bit 0(FFFFFFFF) P 1 CS 001B 32bit 0(FFFFFFFF) A 0 SS 0023 32bit 0(FFFFFFFF) Z 0 DS 0023 32bit 0(FFFFFFFF) S 0 FS 003B 32bit 7FFDF000(FFF) T 0 GS 0000 NULL D 0 O 0 LastErr ERROR_NOT_ENOUGH_MEMORY (00000008) EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G) ST0 empty 0.0 ST1 empty 0.0 ST2 empty 0.5000000000000000000 ST3 empty -2.9802320611338473100e-08 ST4 empty 1.0000000000000000000 ST5 empty 4.3980465111040000000e+12 ST6 empty 5.3123247893381160000e+15 ST7 empty 5.0609752291423027300e+17 3 2 1 0 E S P U O Z D I FST 0020 Cond 0 0 0 0 Err 0 0 1 0 0 0 0 0 (GT) FCW 137F Prec NEAR,64 Mask 1 1 1 1 1 1

The stack's exception handler is overwritten with:

0012DDFC FFFFF94D 0012DE00 0000000A .... .... 0012DF6C 0EDDE2F1 0012DF70 909006EB Pointer to next SEH record 0012DF74 005D88EF SE handler

In the address 005D88EF (the main executable module of PDFCool Studio) we have:

 005D88EF 5D POP EBP 005D88F0 59 POP ECX 005D88F1 C3 RETN

and the stack:

0012DA2C 7C9032A8 RETURN to ntdll.7C9032A8 0012DA30 0012DB14 0012DA34 0012DF70

So, the RETN of 005D88F1 will jump to 12DF70 (the stack) where our shellcode is located:

0012DF70 EB 06 JMP SHORT 0012DF78 0012DF72 90 NOP 0012DF73 90 NOP 0012DF74 EF OUT DX,EAX ; I/O command 0012DF75 885D 00 MOV BYTE PTR SS:[EBP],BL 0012DF78 90 NOP

which means the normal execution flow can be altered in order to execute arbitrary code.

8. Report Timeline

  • 2013-09-03: Core Security Technologies attempts to contact vendor using the IconCool official technical support contact page [4]. No reply received. Publication date is set for Sep 25th, 2013.
  • 2013-09-09: Core attempts to contact vendor.
  • 2013-09-16: Core attempts to contact vendor.
  • 2013-09-25: First release date missed.
  • 2013-10-02: Advisory CORE-2013-0828 published.

9. References

[1] http://www.iconcool.com/index.html.
[2] http://www.iconcool.com/instpdfcoolstudio.exe.
[3] https://www.coresecurity.com/system/files/attachments/2013/10/CORE-2013-0828-PDFCoolStudio-poc.zip.
[4] IconCool technical support page http://www.iconcool.com/support.htm.

10. About CoreLabs

CoreLabs, the research center of Core Security, A Fortra Company is charged with researching and understanding security trends as well as anticipating the future requirements of information security technologies. CoreLabs studies cybersecurity trends, focusing on problem formalization, identification of vulnerabilities, novel solutions, and prototypes for new technologies. The team is comprised of seasoned researchers who regularly discover and discloses vulnerabilities, informing product owners in order to ensure a fix can be released efficiently, and that customers are informed as soon as possible. CoreLabs regularly publishes security advisories, technical papers, project information, and shared software tools for public use at https://www.coresecurity.com/core-labs.  

11. About Core Security, A Fortra Company

Core Security, a Fortra Company, provides organizations with critical, actionable insight about who, how, and what is vulnerable in their IT environment. With our layered security approach and robust threat-aware, identity & access, network security, and vulnerability management solutions, security teams can efficiently manage security risks across the enterprise. Learn more at www.coresecurity.com.

Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or [email protected].

12. Disclaimer

The contents of this advisory are copyright (c) 2013 Core Security Technologies and (c) 2013 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

13. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security advisories team.