CORE-2013-0808 - EPS Viewer Buffer Overflow Vulnerability

Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

EPS Viewer Buffer Overflow Vulnerability

1. Advisory Information

Title: EPS Viewer Buffer Overflow Vulnerability
Advisory ID: CORE-2013-0808
Advisory URL:
http://www.coresecurity.com/advisories/eps-viewer-buffer-overflow-vulnerability
Date published: 2013-08-28
Date of last update: 2013-08-28
Vendors contacted: EPS Viewer Team
Release mode: User release

2. Vulnerability Information

Class: Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-4979

3. Vulnerability Description

EPS Viewer [1], [2] is prone to a security vulnerability when processing
EPS files. This vulnerability could be exploited by a remote attacker to
execute arbitrary code on the target machine by enticing EPS Viewer
users to open a specially crafted EPS file (client-side vulnerability).

4. Vulnerable Packages

   . EPS viewer v3.2.
   . Older versions are probably affected too, but they were not checked.

5. Vendor Information, Solutions and Workarounds

There was no official answer from EPS team after several attempts to
report this vulnerability (see [Sec. 8]). As mitigation action, given
that this is a client-side vulnerability, avoid to open untrusted EPS
files. Contact vendor for further information.

6. Credits

This vulnerability was discovered and researched by Daniel Kazimirow
from Core Exploit Writers Team. The publication of this advisory was
coordinated by Fernando Miranda from Core Advisories Team.

7. Technical Description / Proof of Concept Code

Below is shown the result of opening the maliciously crafted EPS file
[3], which means the normal execution flow can be altered in order to
execute arbitrary code.

/-----
10089B0E . 8BFF MOV EDI,EDI
10089B10 > 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] ;
<— crash (we control ESI)
10089B13 . 8B48 0C MOV ECX,DWORD PTR DS:[EAX+C]
10089B16 . 830E FE OR DWORD PTR DS:[ESI],FFFFFFFE
10089B19 . 85C9 TEST ECX,ECX
10089B1B . 8B7E 04 MOV EDI,DWORD PTR DS:[ESI+4]
10089B1E . 74 0C JE SHORT gsdll32.10089B2C
10089B20 . 50 PUSH EAX
10089B21 . 57 PUSH EDI
10089B22 . 8D56 10 LEA EDX,DWORD PTR DS:[ESI+10]
10089B25 . 52 PUSH EDX
10089B26 . 53 PUSH EBX
10089B27 . FFD1 CALL ECX
; jump to our code
-----/

The vulnerability exists in gldll32.dll module:

/-----
Executable modules, item 1
Base=10000000
Size=00A93000 (11087872.)
Entry=102162B0 gsdll32.<ModuleEntryPoint>
Name=gsdll32
Path=C:\Program Files\EPSViewer\gsdll32.dll

EAX 035126E0 ASCII
"TTEEEETTTTTTTTTTUVWXYZXYTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
ECX 00000000
EDX 00000028
EBX 0358A058
ESP 0012DA98
EBP 54545454
ESI 54544545
EDI 00000038
EIP 10089B10 gsdll32.10089B10
C 1 ES 0023 32bit 0(FFFFFFFF)
P 0 CS 001B 32bit 0(FFFFFFFF)
A 0 SS 0023 32bit 0(FFFFFFFF)
Z 0 DS 0023 32bit 0(FFFFFFFF)
S 1 FS 003B 32bit 7FFDE000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr ERROR_SUCCESS (00000000)
EFL 00000283 (NO,B,NE,BE,S,PO,L,LE)
ST0 empty 0.0
ST1 empty 2.5453186035156250000
ST2 empty 2.1025514602661132810
ST3 empty 320326.00000000000000
ST4 empty -312.81835937500000000
ST5 empty 0.0
ST6 empty 0.2500000000000000000
ST7 empty 250.96191406250000000
3 2 1 0 E S P U O Z D I
FST 0120 Cond 0 0 0 1 Err 0 0 1 0 0 0 0 0 (LT)
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1
-----/

8. Report Timeline

. 2013-08-12:
Core attempts to contact the EPS Viewer team, no reply received.
Publication date is set for Aug 27th, 2013.

. 2013-08-20:
Core attempts to contact vendor.

. 2013-08-26:
Core attempts to contact vendor.

. 2013-08-27:
Release date missed.

. 2013-08-28:
After 3 attempts to contact vendor, the advisory CORE-2013-0808 is
published as 'user release'.

9. References

[1] http://epsviewer.org/.
[2] http://epsviewer.org/download.aspx.
[3]
http://www.coresecurity.com/system/files/attachments/2013/08/CORE-2013-0808-epsviewer-poc-8321106075.zip

10. About CoreLabs

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.

11. About Core Security Technologies

Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.

12. Disclaimer

The contents of this advisory are copyright (c) 2013 Core Security
Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

13. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.