发布日期：2013-01-04
更新日期：2013-01-09
受影响系统：
Foxit Foxit Reader <= 5.4.4.1128
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 57164
CVE(CAN) ID: CVE-2013-0625
Foxit Reader是一款小巧的PDF阅读器。
Foxit Reader npFoxitReaderPlugin.dll是Firefox的插件，npFoxitReaderPlugin.dll在copy字符串时没有正确检查缓冲区边界，导致存在栈溢出漏洞 。攻击者通过诱使用户打开包含超长查询串的特制文件，可达到使应用程序崩溃，甚至执行任意代码的目的。
<*来源：rgod （rgod@autistici.org）
链接：
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
<?php
/*
Foxit Reader <= 5.4.4.1128 Plugin for Firefox npFoxitReaderPlugin.dll Overlong
Query String Remote Stack Buffer Overflow PoC --------------------------- rgod
(listener)
Tested against Microsoft Windows
Mozilla Firefox 17.0.1
Foxit Reader 5.4.3.0920
Foxit Reader 5.4.4.1128
File: npFoxitReaderPlugin.dll
Version: 2.2.1.530
Product url:
Last version setup file: FoxitReader544.11281_enu_Setup.exe
Usage:
Launch from the command line, then browse port 6666 with Firefox.
You can test it also through this url:
?[A x 1024]
File must be existing or the server should be responding with
the proper Content-Type header.
vulnerable code, npFoxitReaderPlugin.dll:
;------------------------------------------------------------------------------
L1000162F:
push ebx
push esi
push edi
mov edi,ebp
or ecx,FFFFFFFFh
xor eax,eax
xor ebx,ebx
xor esi,esi
repne scasb
not ecx
dec ecx
test ecx,ecx
jle L100016E4
L1000164A:
mov al,[esi+ebp]
mov word ptr [esp+18h],0000h
cmp al,25h
jz L10001661
mov ecx,[esp+1Ch]
mov [ebx+ecx],al
jmp L100016CE
L10001661:
mov al,[esi+ebp+01h]
cmp al,30h
jl L1000166D
cmp al,39h
jle L1000167D
L1000166D:
cmp al,41h
jl L10001675
cmp al,46h
jle L1000167D
L10001675:
cmp al,61h
jl L100016C6
cmp al,66h
jg L100016C6
L1000167D:
mov dl,[esi+ebp+01h]
inc esi
inc esi
lea ecx,[esp+10h]
mov [esp+18h],dl
push ecx
mov al,[esi+ebp]
lea edx,[esp+1Ch]
push L100450D4
push edx
mov [esp+25h],al
call SUB_L10006421
mov eax,[esp+1Ch]
lea ecx,[esp+24h]
push eax
push L100450D0
push ecx
call SUB_L100063CF
mov eax,[esp+34h]
mov dl,[esp+30h]
add esp,00000018h
mov [ebx+eax],dl
jmp L100016CE
L100016C6:
mov ecx,[esp+1Ch]
mov byte ptr [ebx+ecx],25h
L100016CE:
inc ebx
mov edi,ebp
or ecx,FFFFFFFFh
xor eax,eax
inc esi
repne scasb
not ecx
dec ecx
cmp esi,ecx
jl L1000164A
L100016E4:
mov edx,[esp+1Ch]
pop edi
pop esi
mov eax,00000001h
mov byte ptr [ebx+edx],00h
pop ebx
pop ebp
pop ecx
retn
;------------------------------------------------------------------------------
this copy loop ends up in overwriting stack pointers, then
(by attaching to plugin-container.exe):