Exploit-DB #17274
Description: SlimPDF Reader - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2011-05-12
Author: Nicolas Krassas

Exploit:
Slimpdf Reader from investintech,
http://www.investintech.com/resources/freetools/slimpdfreader/ is prone to
several overflows that can lead to code execution.  The crash below is
triggered by simply adding 50.000 random characters in the header of a pdf
file. Initial bug and directions to exploitation were given from Jason
Kratzer.

PoC at http://www.deventum.com/research/crash_slimpdf.pdf

CommandLine: "C:\Program Files\Investintech.com Inc\SlimPDF Reader\SlimPDF
Reader.exe"

Executable search path is:
ModLoad: [PII_REDACTED]   SlimPDF Reader.exe
ModLoad: 779c0000 77afd000   ntdll.dll
ModLoad: 76990000 76a64000   C:\Windows\system32\kernel32.dll
ModLoad: 75e10000 75e5a000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 77920000 779c0000   C:\Windows\system32\ADVAPI32.dll
ModLoad: 77[PII_REDACTED]c000   C:\Windows\system32\msvcrt.dll
ModLoad: 75e70000 75e89000   C:\Windows\SYSTEM32\sechost.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\RPCRT4.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\USER32.dll
ModLoad: 767e0000 7682e000   C:\Windows\system32\GDI32.dll
ModLoad: 762c0000 762ca000   C:\Windows\system32\LPK.dll
ModLoad: 75f70000 7600d000   C:\Windows\system32\USP10.dll
ModLoad: 75ef0000 75f6b000   C:\Windows\system32\COMDLG32.dll
ModLoad: 75e90000 75ee7000   C:\Windows\system32\SHLWAPI.dll
ModLoad: 74a40000 74bde000
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\COMCTL32.dll
ModLoad: 76a80000 776c9000   C:\Windows\system32\SHELL32.dll
ModLoad: 6cbf0000 6cc41000   C:\Windows\system32\WINSPOOL.DRV
ModLoad: 6ab80000 6ab9c000   C:\Windows\system32\oledlg.dll
ModLoad: 76[PII_REDACTED]c000   C:\Windows\system32\ole32.dll
ModLoad: 776d0000 7775f000   C:\Windows\system32\OLEAUT32.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\WS2_32.dll
ModLoad: 76a70000 76a76000   C:\Windows\system32\NSI.dll
ModLoad: 74730000 748c0000
C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
ModLoad: 76[PII_REDACTED]a000   C:\Windows\system32\WININET.dll
ModLoad: 75e60000 75e63000   C:\Windows\system32\Normaliz.dll
ModLoad: 76100000 762b6000   C:\Windows\system32\iertutil.dll
ModLoad: 766a0000 767b0000   C:\Windows\system32\urlmon.dll
(9d8.c1c): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=0012fb0c edx=77a06344 esi=fffffffe
edi=00000000
eip=77a5ebbe esp=0012fb28 ebp=0012fb54 iopl=0         nv up ei pl zr na pe
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00000246
ntdll!LdrVerifyImageMatchesChecksum+0x633:
77a5ebbe cc              int     3
0:000> g
ModLoad: 76[PII_REDACTED]f000   C:\Windows\system32\IMM32.DLL
ModLoad: 76030000 760fc000   C:\Windows\system32\MSCTF.dll
ModLoad: 748c0[PII_REDACTED]0   C:\Windows\system32\uxtheme.dll
ModLoad: 73[PII_REDACTED]f000   C:\Windows\system32\inetmib1.dll
ModLoad: 73b90000 73bac000   C:\Windows\system32\IPHLPAPI.DLL
ModLoad: 730d0000 730d7000   C:\Windows\system32\WINNSI.DLL
ModLoad: 6c8d0000 6c8d9000   C:\Windows\system32\snmpapi.dll
ModLoad: 75ab0000 75abc000   C:\Windows\system32\CRYPTBASE.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\dwmapi.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\psapi.dll
ModLoad: 77b00000 77b83000   C:\Windows\system32\CLBCatQ.DLL
ModLoad: 6afe0000 6b038000   C:\Program Files\Common Files\microsoft
shared\ink\tiptsf.dll
ModLoad: 74[PII_REDACTED]b000   C:\Windows\system32\WindowsCodecs.dll
ModLoad: 75a60000 75aab000   C:\Windows\system32\apphelp.dll
ModLoad: 6bdc0000 6bdf1000   C:\Windows\system32\EhStorShell.dll
ModLoad: 762d0000 7646d000   C:\Windows\system32\SETUPAPI.dll
ModLoad: 75d20000 75d47000   C:\Windows\system32\CFGMGR32.dll
ModLoad: 75d00000 75d12000   C:\Windows\system32\DEVOBJ.dll
ModLoad: 74900000 749f5000   C:\Windows\system32\PROPSYS.dll
ModLoad: 6bd50000 6bdba000   C:\Windows\System32\cscui.dll
ModLoad: 6bd40000 6bd49000   C:\Windows\System32\CSCDLL.dll
ModLoad: 714e0000 714eb000   C:\Windows\system32\CSCAPI.dll
ModLoad: 6bcd0000 6bd3f000   C:\Windows\system32\ntshrui.dll
ModLoad: 757f0[PII_REDACTED]0   C:\Windows\system32\srvcli.dll
ModLoad: 73cf0000 73cfa000   C:\Windows\system32\slc.dll
ModLoad: 74ea0000 74ec1000   C:\Windows\system32\ntmarta.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\WLDAP32.dll
ModLoad: 75b60000 75b6b000   C:\Windows\system32\profapi.dll
ModLoad: 755e0000 755f6000   C:\Windows\system32\CRYPTSP.dll
ModLoad: 75380000 753bb000   C:\Windows\system32\rsaenh.dll
ModLoad: 75b20000 75b2e000   C:\Windows\system32\RpcRtRemote.dll
ModLoad: 66[PII_REDACTED]c000   C:\Windows\System32\StructuredQuery.dll
ModLoad: [PII_REDACTED]   C:\Windows\System32\Secur32.dll
ModLoad: 75a40000 75a5a000   C:\Windows\system32\SSPICLI.DLL
ModLoad: 6b450000 6b49e000   C:\Windows\system32\actxprxy.dll
ModLoad: 665e0[PII_REDACTED]0   C:\Program Files\Internet Explorer\ieproxy.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\thumbcache.dll
ModLoad: 6b3f0000 6b41e000   C:\Windows\system32\SHDOCVW.dll
ModLoad: 69f80000 6a8c5000   C:\Windows\system32\ieframe.DLL
ModLoad: 72bb0000 72bec000   C:\Windows\system32\OLEACC.dll
ModLoad: 73440000 734df000   C:\Windows\system32\SearchFolder.dll
ModLoad: 6a9e0000 6ab78000   C:\Windows\system32\NetworkExplorer.dll
ModLoad: 6b4d0000 6b4d9000   C:\Windows\system32\LINKINFO.dll
ModLoad: 74[PII_REDACTED]f000   C:\Windows\system32\samcli.dll
ModLoad: 74a00000 74a12000   C:\Windows\system32\SAMLIB.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\netutils.dll
(9d8.c1c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=01d32eb0 ebx=01d1fdc8 ecx=01d2fd68 edx=00000150 esi=01d32e08
edi=01d2fde8
eip=004419c4 esp=0012ebcc ebp=0012ebe8 iopl=0         nv up ei pl zr na pe
nc
cs=001b  ss=0023  ds=0023  es=0