-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Foxit Reader Multiple Vulnerabilities 1. *Advisory Information* Title: Foxit Reader Multiple Vulnerabilities Advisory ID: CORE-2009-0218 Advisory URL: http://www.coresecurity.com/content/foxit-reader-vulnerabilities Date published: 2009-03-09 Date of last update: 2009-03-09 Vendors contacted: Foxit Software Release mode: Coordinated release 2. *Vulnerability Information* Class: Authorization bypass, Buffer overflow Remotely Exploitable: Yes Locally Exploitable: No Bugtraq ID: 34035 CVE Name: CVE-2009-0836, CVE-2009-0837 3. *Vulnerability Description* Foxit Reader is a lightweight, free PDF document viewer and printer. PDF files may include actions (i.e., 'Go to a page view', 'Open/Execute a file', 'Open a web link', 'Execute a menu item') associated with different triggers (i.e., 'Mouse Up', 'Mouse Down', 'Page Visible', 'Page Invisible'). The way Foxit Reader handles an 'Open/Execute a file' action makes the software victim of two kinds of vulnerabilities: authorization bypass and buffer overflow. 4. *Vulnerable packages* . Foxit Reader 3.0 build 1120 . Foxit Reader 3.0 build 1301 . Older 3.0 builds are probably affected too, but they were not checked. 5. *Non-vulnerable packages* . Foxit Reader 3.0 build 1506 6. *Vendor Information, Solutions and Workarounds* The latest version 3.0 build 1506 of Foxit Reader has been released. Please download the latest version from http://www.foxitsoftware.com/downloads/ and visit the Foxit security page for details at http://www.foxitsoftware.com/pdf/reader/security.htm. 7. *Credits* These vulnerabilities were discovered and researched by Francisco Falcón from Core Security Technologies. 8. *Technical Description / Proof of Concept Code* PDF files may include actions (i.e., 'Go to a page view', 'Open/Execute a file', 'Open a web link', 'Execute a menu item') associated with different triggers (i.e., 'Mouse Up', 'Mouse Down', 'Page Visible', 'Page Invisible'). The way Foxit Reader handles an 'Open/Execute a file' action makes the software victim of two kinds of vulnerabilities. The first one is an authorization bypass vulnerability (CVE-2009-0836). If an 'Open/Execute a file' action is defined in the PDF file, when the trigger condition is satisfied, Foxit Reader will open/execute the file defined by the creator of the PDF file without asking the user for confirmation. A proof of concept PDF file is included [4]. The second one is a stack-based buffer overflow (CVE-2009-0837). If an 'Open/Execute a file' action is defined in the PDF file with an overly long filename argument, when the trigger condition is satisfied it will cause a stack-based buffer overflow, because the application tries to copy the filename argument to a fixed-size buffer in the stack without properly checking that the buffer is large enough to hold the filename string. Proof of concept PDF file also included [5]. If an 'Open/Execute a file' is defined in a PDF file, when the trigger condition is satisfied, Foxit Reader first determines if the filename argument has a relative path: /----------- 00403029 |> 50 PUSH EAX ; /Path 0040302A |. FF15 10278D00 CALL DWORD PTR DS:[<&SHLWAPI.PathIsRelativeA>] ; \PathIsRelativeA - -----------/ If the 'PathIsRelativeA' API returns True, then Foxit Reader will append the path of the current PDF file at the beginning of the filename string. If the filename argument is large enough, it will cause a stack-based buffer overflow when the application tries to concatenate the path and the filename: /----------- 004030B2 |> 55 PUSH EBP ; /Arg5 004030B3 |. 50 PUSH EAX ; |Arg4 = filename with relative path 004030B4 |. 8D8424 600500>LEA EAX,DWORD PTR SS:[ESP+560] ; | 004030BB |. 8D8C24 200400>LEA ECX,DWORD PTR SS:[ESP+420] ; | 004030C2 |. 50 PUSH EAX ; |Arg3 = path of the current PDF file 004030C3 |. 55 PUSH EBP ; |Arg2 004030C4 |. 51 PUSH ECX ; |Arg1 = destination stack buffer 004030C5 |. E8 06ED0A00 CALL Foxit_Re.004B1DD0 ; \Foxit_Re.004B1DD0 - -----------/ Inside the function beginning at address 004B1DD0, the application first copies the path of the current PDF file to the buffer located in the stack: /----------- 004B1DED |> 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] ; ESI = destination stack buffer 004B1DF0 |> 8B55 10 MOV EDX,DWORD PTR SS:[EBP+10] ; EDX = path of the current PDF file 004B1DF3 |. 85D2 TEST EDX,EDX 004B1DF5 |. 8BCA MOV ECX,EDX 004B1DF7 |. 74 28 JE SHORT Foxit_Re.004B1E21 004B1DF9 |. 8A02 MOV AL,BYTE PTR DS:[EDX] 004B1DFB |. 84C0 TEST AL,AL 004B1DFD |. 74 22 JE SHORT Foxit_Re.004B1E21 004B1DFF |> 8806 /MOV BYTE PTR DS:[ESI],AL ; copy path to stack buffer 004B1E01 |. 8A41 01 |MOV AL,BYTE PTR DS:[ECX+1] 004B1E04 |. 46 |INC ESI 004B1E05 |. 41 |INC ECX 004B1E06 |. 84C0 |TEST AL,AL 004B1E08 |.^ 75 F5 \JNZ SHORT Foxit_Re.004B1DFF - -----------/ And after that, it appends the filename string: /----------- 004B1E1D |. C606 5C MOV BYTE PTR DS:[ESI],5C ; append a '\' at the end of the path 004B1E20 |. 46 INC ESI ; point to the next destination byte 004B1E21 |> 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14] ; EAX = filename with relative path 004B1E24 |. 85C0 TEST EAX,EAX 004B1E26 |. 8BC8 MOV ECX,EAX 004B1E28 |. 74 0F JE SHORT Foxit_Re.004B1E39 004B1E2A |. 8A00 MOV AL,BYTE PTR DS:[EAX] 004B1E2C |> 84C0 /TEST AL,AL 004B1E2E |. 74 09 |JE SHORT Foxit_Re.004B1E39 004B1E30 |. 8806 |MOV BYTE PTR DS:[ESI],AL ; copy filename to stack buffer 004B1E32 |. 8A41 01 |MOV AL,BYTE PTR DS:[ECX+1] 004B1E35 |. 46 |INC ESI 004B1E36 |. 41 |INC ECX 004B1E37 |.^ EB F3 \JMP SHORT Foxit_Re.004B1E2C - -----------/ Otherwise, if the filename argument has an absolute path, Foxit Reader simply copies the filename to a buffer in the stack without checking its length: /----------- 004030FE |. 8BF7 MOV ESI,EDI ; ESI = source filename argument 00403100 |. 8BFA MOV EDI,EDX ; EDI = destination stack buffer 00403102 |. C1E9 02 SHR ECX,2 ; ECX = number of dwords to copy 00403105 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] ; BUFFER OVERFLOW - -----------/ In both cases, with relative or absolute path, if the filename is large enough, it will cause a buffer overflow in the stack, making it possible for the attacker to overwrite return addresses and the Structured Exception Handler, allowing the execution of arbitrary code with the privileges of the current user. Attackers may embed JavaScript code in the PDF file to spray the heap with their shellcode before triggering the buffer overflow vulnerability. 9. *Report Timeline* . 2009-02-20: Core Security Technologies notifies the Foxit Reader team of the vulnerability. . 2009-02-23: The Foxit Reader team asks Core for a technical description of the vulnerability. . 2009-02-23: Technical details sent to Foxit Reader team by Core. . 2009-02-25: Vendor confirms the bugs and patches: a prompt was added for local file execution and a length check for the buffer overflow. Vendor comments that the patches will be sent to Core for confirmation. . 2009-02-25: Core acknowledges and says that the patches will be tested. . 2009-02-27: Vendor sends a link to download the patched Foxit Reader. . 2009-03-03: Vendor asks for any information regarding the patch confirmation. . 2009-03-03: Core confirms the authorization bypass bug was fixed but the buffer overflow fix raise another, more difficult to exploit, issue related to a missing check of API HeapReAlloc returning a valid pointer or not. . 2009-03-04: Vendor says that once they detect a memory reallocation failure, they will clear the buffer and make it empty. . 2009-03-04: Core suggests that the proper thing to do is to enforce a maximum length limit on the filename argument, as explained on programming documentation [2]. . 2009-03-04: Vendor says that in the reallocation fail scenario, as the application is already running out of memory, there is no way to gracefully and reliably close the application. . 2009-03-05: Core informs the vendor that the authorization bypass bug has been independently discovered by another security researcher and published on the Internet [3]. Also suggests to publish the patches and advisory on the planned schedule, March 9th, disregarding any delay due to the missing check in the patch including the call to HeapReAlloc. . 2009-03-06: Vendor sends a new version and asks for fix. . 2009-03-09: Vendor releases patches for this flaw to its customers. . 2009-03-09: The advisory CORE-2009-0218 is published by Core and the vendor is notified that the buffer overflow patch works as expected. 10. *References* [1] Foxit Software Company http://www.foxitsoftware.com/ [2] File Names, Paths, and Namespaces http://msdn.microsoft.com/en-us/library/aa365247(VS.85).aspx [3] Simple Remote code execution in PDF still riding.. http://blog.zoller.lu/2009/03/remote-code-execution-in-pdf-still.html [4] Authorization bypass http://www.coresecurity.com/files/attachments/CORE-2009-0218-PoC-authorization-bypass.pdf [5] Buffer overflow http://www.coresecurity.com/files/attachments/CORE-2009-0218-PoC-BOF.pdf 11. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://www.coresecurity.com/corelabs. 12. *About Core Security Technologies* Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the most comprehensive product for performing enterprise security assurance testing. CORE IMPACT evaluates network, endpoint and end-user vulnerabilities and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core Security Technologies augments its leading technology solution with world-class security consulting services, including penetration testing and software security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2009 Core Security Technologies and (c) 2009 CoreLabs, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given. 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJtXCwyNibggitWa0RAu8GAJ45qFT1lQnIKHD7TZEKcvKkSWtRegCfRHun pTg5BtPWfDaeHh/o0Jc//Cw= =M175 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/