Exploit-DB #15296
Description: Adobe Shockwave Player - 'rcsL chunk' Memory Corruption
Type: remote
Platform: windows
Date: 2010-10-21
Author: Abysssec

Exploit:
Abysssec Inc Public Advisory


1) Advisory information

  Title               :  Adobe Shockwave player rcsL chunk memory corruption
  Version             :  Adobe Shockwave player  11.5.8.612 (latest on writing time)
  Discovery           :  http://www.abysssec.com
  Vendor              :  http://www.adobe.com
  Impact              :  Critical
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec 
  CVE                 :  ZeroDay Not Patched


3) Vulnerability information

Class - Memory corruption allow command execute
Impact - Successfully exploiting this issue allows remote attackers to execute arbitrary code or cause denial-of-service conditions.
Remotely Exploitable - Yes
Locally Exploitable - Yes

4) Vulnerabilities detail

Introduction 
Shockwave player is a plug in for loading Adobe Director video files in to the browser. Director movies have DIR or compressed format of DCR.  DIR file format is based on RIFF based formats. RIFF formats start with a 4byte RIFX identifier and length of the file. And subsequently chunks come together with format of 4byte chunk identifier + size of chunk + data. Some of the chunk identifiers are tSAC, pami, rcsL. 
By help of our simple fuzzer we have manipulated a director movie file and found a vulnerability in part of an existing rcsL chunk.

Vulnerability explanation 
There is a 4bytes value in the undocumented rcsL chunk in our sample director movie and it may be possible to find similar rcsL chunks in other director samples. The 4bytes so called value can be manipulated to reach the vulnerable part of function 68122990. 
Here is the function: 

.text:68122990 sub_68122990    proc near               ; CODE XREF: sub_68112120+1A57p
.text:68122990                                         ; DATA XREF: sub_68122F30+4AAo
.text:68122990
.text:68122990 var_8           = dword ptr -8
.text:68122990 var_4           = dword ptr -4
.text:68122990 arg_0           = dword ptr  4
.text:68122990 arg_4           = dword ptr  8
.text:68122990
.text:68122990                 sub     esp, 8
.text:68122993                 mov     eax, [esp+8+arg_4]
.text:68122997                 push    ebx
.text:68122998                 push    ebp
.text:68122999                 push    esi
.text:6812299A                 mov     esi, [esp+14h+arg_0]
.text:6812299E                 push    edi
.text:6812299F                 push    eax
.text:681229A0                 push    esi
.text:681229A1                 call    sub_680FC6D0
.text:681229A6                 mov     ecx, [esi+18h]
.text:681229A9                 mov     edx, [esi+10h]
.text:681229AC                 mov     ebp, [esi+1Ch]
.text:681229AF                 mov     ebx, [esi+20h]
.text:681229B2                 add     ecx, 0FFFFFFF8h
.text:681229B5                 cmp     ebp, 3
.text:681229B8                 mov     [esp+18h+arg_0], eax
.text:681229BC                 mov     [esi+18h], ecx
.text:681229BF                 mov     eax, [edx]
.text:681229C1                 mov     edx, [eax+ecx]
.text:681229C4                 lea     edi, [esi+1Ch]
.text:681229C7                 mov     [edi], edx
.text:681229C9                 mov     eax, [eax+ecx+4]
.text:681229CD                 mov     [edi+4], eax
.text:681229D0                 mov     [esp+18h+var_8], 4
.text:681229D8                 mov     [esp+18h+var_4], 0
.text:681229E0                 jz      short loc_681229F6
.text:681229E2                 push    ebx
.text:681229E3                 push    ebp
.text:681229E4                 push    0Ch
.text:681229E6                 push    esi
.text:681229E7                 call    sub_680FCFB0
.text:681229EC                 pop     edi
.text:681229ED                 pop     esi
.text:681229EE                 pop     ebp
.text:681229EF                 pop     ebx
.text:681229F0                 add     esp, 8
.text:681229F3                 retn    8
.text:681229F6 ; ---------------------------------------------------------------------------
.text:681229F6
.text:681229F6 loc_681229F6:                           ; CODE XREF: sub_68122990+50j
.text:681229F6                 mov     ecx, [ebx]
.text:681229F8                 mov     edx, [ecx]
.text:681229FA                 mov     ecx, [esp+18h+arg_0]
.text:681229FE                 lea     eax, [esp+18h+var_8]
.text:68122A02                 push    eax
.text:68122A03                 push    ecx
.text:68122A04                 push    ebx
.text:68122A05                 push    esi
.text:68122A06                 call    dword ptr [edx+2Ch]
.text:68122A09                 mov     ecx, [esi+7Ch]
.text:68122A0C                 test    ecx, ecx
.text:68122A0E                 jz      short loc_68122A22
.text:68122A10                 push    ebx
.text:68122A11                 push    ebp
.text:68122A12                 push    esi
.text:68122A13                 call    sub_680FC730
.text:68122A18                 pop     edi
.text:68122A19                 pop     esi
.text:68122A1A                 pop     ebp
.text:68122A1B                 pop     ebx
.text:68122A1C                 add     esp, 8
.text:68122A1F                 retn    8
.text:68122A22 ; ---------------------------------------------------------------------------
.text:68122A22
.text:68122A22 loc_68122A22:                           ; CODE XREF: sub_68122990+7Ej
.text:68122A22                 test    eax, eax
.text:68122A24                 jnz     loc_68122AAC
.text:68122A2A                 push    esi
.text:68122A2B                 call    sub_680FD9D0
.text:68122A30                 push    edi
.text:68122A31                 push    esi
.text:68122A32                 mov     [edi], ebp
.text:68122A34                 mov     [edi+4], ebx
.text:68122A37                 call    sub_680FC7C0
.text:68122A3C                 push    esi
.text:68122A3D                 c