Exploit-DB #24741
Description: TagScanner 5.1 - Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2013-03-13
Author: Vulnerability-Lab

Exploit:
Title:
======
TagScanner v5.1 - Stack Buffer Overflow Vulnerability


Date:
=====
2013-01-22


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=831


VL-ID:
=====
831


Introduction:
=============
TagScanner is a multifunction program for organizing and managing your music collection. It can edit tags of mostly state-of-the-art 
audio formats, rename files based on the tag information, generate tag information from filenames, and perform any transformations of 
the text from tags and filenames. Also you may get album info via online databases like freedb or Amazon. Supports ID3v1, ID3v2, 
Vorbis comments, APEv2, WindowsMedia and MP4(iTunes) tags.

- Rename files based on the tag and file information
- Powerful multiple files tag editor
- Import tag information and album art from online databases like freedb or Amazon
- Generate tag information from file/foldernames
- Tag fields formatting and rearrangement
- Words replacement and case conversion from tags and filenames
- Supports MP3, OGG, FLAC, WMA, MPEG-4, Opus, Musepack, Monkey`s Audio, AAC, OptimFROG, SPEEX, WavPack, TrueAudio files
- Supports ID3 1.0/1.1/2.2/2.3/2.4 tags, APE v1 and v2 tags, Vorbis Comments, WMA tags and MP4(iTunes) metadata
- Supports for embedded lyrics and cover art
- Resize cover art for portable devices on the fly
- TAGs versions conversions
- Quick playlists creation
- Export information to HTML, XML CSV or any user-defined format
- Full support for Unicode
- Multilanguage interface
- Built-in multiformat player

Powerful TAG editor with batch functions and special features. Playlist maker with ability to export playlists to HTML or Excel. 
Easy-to-use interface. Built-in player.

(Copy of the Vendor Homepage: http://www.xdlab.ru/ )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered a local stack buffer overflow vulnerability in the Yandex xdLab TagScanner v5.1 software.


Report-Timeline:
================
2013-01-22:	Public Disclosure


Status:
========
Published


Affected Products:
==================
Yandex - XDLab
Product: TagScanner 5.1


Exploitation-Technique:
=======================
Local


Severity:
=========
High


Details:
========
A local stack buffer overflow vulnerability is detected in the official Yandex xdLab TagScanner v5.1 software. 
The buffer overflow occurs when data written to a buffer, due to insufficient bounds checking, corrupts data values 
in memory addresses adjacent to the allocated buffer.

The vulnerability is located in the `rename` module of the software when processing to load the `rename folder by tag` 
function as listing. Local attackers can use the `Edit template` function of the rename module to overflow the memory 
when processing to (buffer) list the inserted context (large). When the victim is processing to click with another system 
user account the syncronized software context and clicks on the rename function for the tag listing the overflow occurs.
The vulnerable add input parameters to exploit the local vulnerability are `Custom Genres` & `Templates for Foldernames`.

The vulnerability can be exploited by privileged system user accounts with low or medium required user interaction.
Successful exploitation of the buffer overflow vulnerability results in overruns of the buffer(s) boundary and overwrites adjacent memory.

Vulnerable Module(s):
				[+] Rename Folder by TAG - Genres and Templates

Vulnerable Parameter(s):
				[+] Custom Genres - Add
				[+] Templates for Folderanmes - Add

Affected Module(s):
				[+] Rename Folder by TAG - TAG Listing (Component)


Proof of Concept:
=================
The vulnerability can be exploited by local attackers with privileged system user account and medium required user interaction. For demonstration or reproduce ...

Manually steps to reproduce ...

1.   Download the TagScanner v5.1 software of the yandex dxlab
2.   Start the software and include any random track from your hd to the main listing
3.   Click (Right) with the mouse on the listed track and open the rename folder by tag main function
4.   Click  ... > Edit templates
5.   Open the Genres and Templates section in the module
6.   Now choose one of the add function and click on + (Custom Genres or Templates for Foldernames)
7.   Start your fuzzer to process the request or include manually a large string (x bytes) since the block is empty
8.   Save it by opening the big black arrow (Left|Top) in the menu
9.   Choose the track by an easy click, click with right mouse button again and open the rename folder by tag listing
10. The software will crash the and the overflow with the ability to overwrite occurs


--- Debug Logs (Exception) ---

(13e8.11dc): AV - code c0000005 (first chance)
eax=00000000 ebx=00000000 ecx=00410041 edx=779cb46d esi=00000000 edi=00000000
eip=41414141 esp=0018ea90 ebp=0018eab0 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Tagscan+0x10041:
4[PII_REDACTED]            add     byte ptr [eax],al          ds:002b:00000000=??
0:000> !exchain
0018eaa4: ntdll!LdrRemoveLoadAsDataTable+d64 (779cb46d)
0018eed0: Tagscan+14420 (00414420)
0018eef0: Tagscan+1ead78 (005ead78)
0018f154: Tagscan+10041 (41414141)
Invalid exception stack at 41414141
0:000> u
Tagscan+0x10041:
4[PII_REDACTED]            add     byte ptr [eax],al
00410043 00ac[PII_REDACTED]  add     byte ptr [eax+eax+41h],ch
0041004a 0000            add     byte ptr [eax],al
0041004c 0000            add     byte ptr [eax],al
0041004e 0000            add     byte ptr [eax],al
00[PII_REDACTED]            add     byte ptr [eax],al
00[PII_REDACTED]            add     byte ptr [eax],al
00410054 94              xchg    eax,esp
0:000> a
41414141

--- APPCrash Logs ---
EventType=APPCRASH (BEX)
EventTime=[PII_REDACTED]6060019
ReportType=2
Consent=1
Repo