####################################################################### Luigi Auriemma Application: Microsoft Reader http://www.microsoft.com/reader Versions: <= 2.1.1.3143 (PC version) <= 2.6.1.7169 (Origami version) the non-PC versions have not been tested Platforms: Windows, Windows Mobile, Tablet PC and UMPC devices Bug: integer overflow Date: 11 Apr 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Microsoft Reader is a software needed to read and catalog the ebooks in LIT format and the Audible audio books bought via internet, indeed the homepage acts also as online store for these protected contents. ####################################################################### ====== 2) Bug ====== Heap overflow caused by controlled memmove: 0107100D /$ 55 PUSH EBP 0107100E |. 8BEC MOV EBP,ESP 01071010 |. 83EC 38 SUB ESP,38 01071013 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 01071016 |. 53 PUSH EBX 01071017 |. 8B5D 14 MOV EBX,DWORD PTR SS:[EBP+14] 0107101A |. 56 PUSH ESI 0107101B |. 8B40 20 MOV EAX,DWORD PTR DS:[EAX+20] 0107101E |. 57 PUSH EDI 0107101F |. 3B58 2C CMP EBX,DWORD PTR DS:[EAX+2C] 01071022 |. 72 07 JB SHORT msreader.0107102B 01071024 |. 33C0 XOR EAX,EAX 01071026 |. E9 38020000 JMP msreader.01071263 0107102B |> 8BF3 MOV ESI,EBX 0107102D |. 8B40 20 MOV EAX,DWORD PTR DS:[EAX+20] ; 0x00002000 01071030 |. C1E6 05 SHL ESI,5 01071033 |. 0375 10 ADD ESI,DWORD PTR SS:[EBP+10] 01071036 |. 83E8 10 SUB EAX,10 ; 0x00001ff0 01071039 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX 0107103C |. 8B7E 08 MOV EDI,DWORD PTR DS:[ESI+8] 0107103F |. 8B4E 14 MOV ECX,DWORD PTR DS:[ESI+14] 01071042 |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX 01071045 |. 8B57 04 MOV EDX,DWORD PTR DS:[EDI+4] 01071048 |. 8955 EC MOV DWORD PTR SS:[EBP-14],EDX 0107104B |. 8D5439 10 LEA EDX,DWORD PTR DS:[ECX+EDI+10] 0107104F |. 8955 FC MOV DWORD PTR SS:[EBP-4],EDX 01071052 |. 33D2 XOR EDX,EDX 01071054 |. 3BDA CMP EBX,EDX 01071056 |. 8B5D 0C MOV EBX,DWORD PTR SS:[EBP+C] 01071059 |. 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX 0107105C |. 75 2D JNZ SHORT msreader.0107108B 0107105E |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8] 01071061 |. 8345 FC 20 ADD DWORD PTR SS:[EBP-4],20 01071065 |. 83E8 20 SUB EAX,20 ; 0x00001fd0 01071068 |. 3951 38 CMP DWORD PTR DS:[ECX+38],EDX 0107106B |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX 0107106E |. 74 2E JE SHORT msreader.0107109E 01071070 |. FF73 0C PUSH DWORD PTR DS:[EBX+C] 01071073 |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] 01071076 |. 50 PUSH EAX 01071077 |. E8 E7450100 CALL msreader.01085663 0107107C |. 59 POP ECX 0107107D |. 59 POP ECX 0107107E |. 8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C] 01071081 |. 2BC1 SUB EAX,ECX 01071083 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX 01071086 |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] 01071089 |. EB 13 JMP SHORT msreader.0107109E 0107108B |> 3955 18 CMP DWORD PTR SS:[EBP+18],EDX 0107108E |. 74 0E JE SHORT msreader.0107109E 01071090 |. 8B56 1C MOV EDX,DWORD PTR DS:[ESI+1C] 01071093 |. 0356 18 ADD EDX,DWORD PTR DS:[ESI+18] 01071096 |. 03CA ADD ECX,EDX 01071098 |. 0155 FC ADD DWORD PTR SS:[EBP-4],EDX 0107109B |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX 0107109E |> 8B4B 0C MOV ECX,DWORD PTR DS:[EBX+C] 010710A1 |. 034B 08 ADD ECX,DWORD PTR DS:[EBX+8] 010710A4 |. 034D F8 ADD ECX,DWORD PTR SS:[EBP-8] 010710A7 |. 3B4D EC CMP ECX,DWORD PTR SS:[EBP-14] 010710AA |. 894D 0C MOV DWORD PTR SS:[EBP+C],ECX 010710AD |. 0F87 61010000 JA msreader.01071214 010710B3 |. 2B45 EC SUB EAX,DWORD PTR SS:[EBP-14] ; substract AOLL size 010710B6 |. 2B45 F4 SUB EAX,DWORD PTR SS:[EBP-C] ; substract the size at the end of the chunk 010710B9 >|. 74 24 JE SHORT msreader.010710DF 010710BB |. 50 PUSH EAX 010710BC |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 010710BF |. 03C8 ADD ECX,EAX 010710C1 |. 50 PUSH EAX 010710C2 |. 51 PUSH ECX 010710C3 |. E8 103C0200 CALL ; memmove So through the controlling of the 32bit value after the AOLL tag and/or the 16bit one at the end of the chunk (offset 0x23ba of the provided PoC) is possible to exploit the integer overflow for performing the memmove of an arbitrary amount of data. In the proof-of-concept I have set the amount of bytes to move to 0xffffffff for a quick and easy demonstration. Modified bytes in the proof-of-concept: 000003DC 2B 6A ; little endian 32bit value 000003DD 17 18 from offset 0xb6e till 0x23b0 I have replaced the original data with a sequence of 'A's. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/msreader_3.zip ####################################################################### ====== 4) Fix ====== No fix. #######################################################################