Headline

CVE-2016-8713: TALOS-2016-0226 || Cisco Talos Intelligence Group

A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10.5.9.9. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.

7 years ago

CVE

Open in Source

#vulnerability #mac #microsoft #cisco #intel #pdf #amd

Summary

Tested Versions

Nitro Pro 10.5.9.9 (Nitro PDF Library - 10, 5, 9, 9) - x64 version

Product URLs

http://gonitro.com

CVSSv3 Score

8.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

A memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption.

Vulnerable code is located in the npdf.dll library:

 .text:0000000000268C20 loc_268C20:                             ; CODE XREF: sub_268BE0+A6j
 .text:0000000000268C20                 movsxd  rax, dword ptr [r9+800h]
 .text:0000000000268C27                 mov     rcx, rax
 .text:0000000000268C2A                 add     rcx, rcx
 .text:0000000000268C2D                 movups  xmm1, xmmword ptr [r9+rcx*8]
 .text:0000000000268C32                 lea     ecx, [r10-1]
 .text:0000000000268C36                 add     ecx, eax
 .text:0000000000268C38                 cmp     eax, ecx
 .text:0000000000268C3A                 jge     short write_bug
 .text:0000000000268C3C                 mov     r8, rax
 .text:0000000000268C3F                 shl     r8, 4
 .text:0000000000268C43                 add     r8, r9
 .text:0000000000268C46                 db      66h, 66h
 .text:0000000000268C46                 nop     word ptr [rax+rax+00000000h]
 .text:0000000000268C50
 .text:0000000000268C50 loc_268C50:                             ; CODE XREF: sub_268BE0+8Ej
 .text:0000000000268C50                 movups  xmm0, xmmword ptr [r8+10h]
 .text:0000000000268C55                 inc     eax
 .text:0000000000268C57                 lea     r8, [r8+10h]
 .text:0000000000268C5B                 movups  xmmword ptr [r8-10h], xmm0
 .text:0000000000268C60                 mov     edx, [r9+800h]
 .text:0000000000268C67                 dec     edx
 .text:0000000000268C69                 add     edx, r10d
 .text:0000000000268C6C                 cmp     eax, edx
 .text:0000000000268C6E                 jl      short loc_268C50
 .text:0000000000268C70
 .text:0000000000268C70 write_bug:                              ; CODE XREF: sub_268BE0+5Aj
 .text:0000000000268C70                 movsxd  rax, dword ptr [r9+800h]
 .text:0000000000268C77                 add     rax, r10
 .text:0000000000268C7A                 add     rax, rax
 .text:0000000000268C7D                 movups  xmmword ptr [r9+rax*8-10h], xmm1 ; * overwrite *
 .text:0000000000268C83                 dec     r11
 .text:0000000000268C86                 jnz     short loc_268C20

Memory access refered by selected instruction is presented below:

 0x268C20 ### mem read addr=0xd447740   rax=[mem]=78
 0x268C2D ### mem read addr=0xd4476c0   xmm1=[mem]=2
 0x268C50 ### mem read addr=0xd4476d0   xmm0=[mem]=2
 0x268C5B ### mem write addr=d4476c0  [mem]=2 xmm0=2
 0x268C50 ### mem read addr=0xd4476e0   xmm0=[mem]=2
 0x268C5B ### mem write addr=d4476d0  [mem]=2 xmm0=2
 0x268C50 ### mem read addr=0xd4476f0   xmm0=[mem]=2
 0x268C5B ### mem write addr=d4476e0  [mem]=2 xmm0=2
 0x268C50 ### mem read addr=0xd447700   xmm0=[mem]=2
 0x268C5B ### mem write addr=d4476f0  [mem]=2 xmm0=2
 0x268C50 ### mem read addr=0xd447710   xmm0=[mem]=2
 0x268C5B ### mem write addr=d447700  [mem]=2 xmm0=2
 0x268C50 ### mem read addr=0xd447720   xmm0=[mem]=2
 0x268C5B ### mem write addr=d447710  [mem]=2 xmm0=2
 0x268C50 ### mem read addr=0xd447730   xmm0=[mem]=2
 0x268C5B ### mem write addr=d447720  [mem]=2 xmm0=2
 0x268C50 ### mem read addr=0xd447740   xmm0=[mem]=78
 0x268C5B ### mem write addr=d447730  [mem]=2 xmm0=78
 0x268C50 ### mem read addr=0xd447750   xmm0=[mem]=abababab
 0x268C5B ### mem write addr=d447740  [mem]=78 xmm0=abababab
 0x268C70 ### mem read addr=0xd447740   rax=[mem]=abababab
 0x268C7D ### mem write addr=c7ff2aa0  [mem]=Memory access error

Last memory access (instruction at 0x268C7D) is causing the exception to trigger. Instruction at 0x268C7D is using RAX register value to calculate the final memory address. RAX value is calculated by reading 32-bit memory from [r9+0x800] (with sign extension). Value at [r9+0x800] in this case is 0xABABABAB which is Microsoft’s HeapAlloc() mark of “no man’s land” guard bytes after allocated heap memory. In other words this memory should be never referenced in the first place. This value is later increased by r10 value (address 0x268C77) and multiplied by 2 (address 0x268C7A).

Crash Information

 0:000> !analyze -v
 *******************************************************************************
 *                                                                             *
 *                        Exception Analysis                                   *
 *                                                                             *
 *******************************************************************************

 *** ERROR: Symbol file could not be found.  Defaulted to export symbols for NitroPDF.exe -
 *** ERROR: Symbol file could not be found.  Defaulted to export symbols for J:\nitro\Nitro_KissMetrics.dll -

 FAULTING_IP:
 npdf!CxImage###~CxImage+9474d
 000007fe`da958c7d 410f114cc1f0    movups  xmmword ptr [r9+rax*8-10h],xmm1

 EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
 ExceptionAddress: 000007feda958c7d (npdf!CxImage###~CxImage+0x000000000009474d)
    ExceptionCode: c000041d
    ExceptionFlags: 00000001
 NumberParameters: 0

 CONTEXT:  0000000000000000 -- (.cxr 0x0;r)
 rax=ffffffff5757576e rbx=00000000010eaf80 rcx=0000000000000083
 rdx=00000000abababb6 rsi=0000000077b31148 rdi=00000000010eb470
 rip=000007feda958c7d rsp=00000000010eb690 rbp=000000000d9dff90
  r8=000000000db9b200  r9=000000000db9a9f0 r10=000000000000000c
 r11=0000000000000003 r12=000000000d9c6d50 r13=000000000d9dfcb8
 r14=00000000010ebf38 r15=000000000d94f8b0
 iopl=0         nv up ei ng nz na pe cy
 cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010281
 npdf!CxImage###~CxImage+0x9474d:
 000007fe`da958c7d 410f114cc1f0    movups  xmmword ptr [r9+rax*8-10h],xmm1 ds:fffffffa`c8746550=????????????????????????????????

 FAULTING_THREAD:  0000000000009ff4

 DEFAULT_BUCKET_ID:  APPLICATION_FAULT

 PROCESS_NAME:  NitroPDF.exe

 ERROR_CODE: (NTSTATUS) 0xc000041d - Wyst

 EXCEPTION_CODE: (NTSTATUS) 0xc000041d - Wyst

 DETOURED_IMAGE: 1

 NTGLOBALFLAG:  470

 APPLICATION_VERIFIER_FLAGS:  0

 APP:  nitropdf.exe

 ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

 PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

 BUGCHECK_STR:  APPLICATION_FAULT_APPLICATION_FAULT

 LAST_CONTROL_TRANSFER:  from 000007feda95754c to 000007feda958c7d

 STACK_TEXT:
 00000000`010eb690 000007fe`da95754c : 00000000`00003153 00000000`00000000 00000000`010f0200 00000000`010f3153 : npdf!CxImage###~CxImage+0x9474d
 00000000`010eb6a0 000007fe`da958ef5 : 00000000`0d9dff90 00000000`010ebd20 00000000`010ebc30 00000000`0d9c6d50 : npdf!CxImage###~CxImage+0x9301c
 00000000`010eb6f0 000007fe`da8a4729 : 00000000`0db80aa0 00000000`010ebd20 00000000`010ebc30 00000000`0d9dfcb8 : npdf!CxImage###~CxImage+0x949c5
 00000000`010eb720 000007fe`da8452b9 : 00000000`010ebd20 00000000`0d9dfcb8 00000000`010ebc30 00000000`77a3ab58 : npdf!TerminateApp+0xedfc9
 00000000`010eb750 000007fe`da8ceb01 : 00000000`010f0000 00000000`009c009a 00000000`0d9dfcb8 00000000`010ebc60 : npdf!TerminateApp+0x8eb59
 00000000`010ebbd0 000007fe`da923daf : 00000000`00000060 00000000`0d9d7e08 00000000`00000001 00000000`010f0000 : npdf!CxImage###~CxImage+0xa5d1
 00000000`010ebc20 000007fe`da93529b : 00000000`00000002 00000000`0d9d7e08 00000000`00000000 00000000`00000002 : npdf!CxImage###~CxImage+0x5f87f
 00000000`010ebeb0 000007fe`da8da4a8 : 00000000`00000002 00000000`00000000 00080000`00100081 000007fe`da700000 : npdf!CxImage###~CxImage+0x70d6b
 00000000`010ec580 000007fe`da8dc0dc : 00000000`00000002 00000000`010ec700 00000000`00000002 00000000`0d9d7cd0 : npdf!CxImage###~CxImage+0x15f78
 00000000`010ec600 000007fe`da8d2dc8 : 00000000`010f0000 00000000`0d9d7cd0 00000000`00000000 00000000`00000000 : npdf!CxImage###~CxImage+0x17bac
 00000000`010ec7e0 000007fe`da8f68e0 : 00000000`0d9dfc80 00000000`010ee900 00000000`00000000 00000000`00000000 : npdf!CxImage###~CxImage+0xe898
 00000000`010ecc60 000007fe`da8db70e : 00000000`0d9c6d50 00000000`0d9c6d50 00000000`0d9d7cd0 00000000`0d9dd660 : npdf!CxImage###~CxImage+0x323b0
 00000000`010ed170 000007fe`da823752 : 00000000`0d9d7cd0 00000000`047e8040 0409001f`00000000 00000000`0d950780 : npdf!CxImage###~CxImage+0x171de
 00000000`010ed6a0 000007fe`da824d45 : 00000000`0d950590 000007fe`fedf6a47 00000000`00000000 000007fe`fedf6941 : npdf!TerminateApp+0x6cff2
 00000000`010edc30 00000001`3fc29bbc : 00000000`00000000 00000000`0d950590 00000000`010ee9e0 00000000`0d950590 : npdf!TerminateApp+0x6e5e5
 00000000`010edc80 00000001`3fc2ec72 : 00000000`0d949e90 00000000`00000404 00000000`0d94a408 00000000`010ee9e0 : NitroPDF!CxMemFile###Scanf+0x6dbbc
 00000000`010ee370 000007fe`e1104b26 : 00000000`010ee850 00000000`010ee888 00000000`0d949e90 000007fe`fedf1169 : NitroPDF!CxMemFile###Scanf+0x72c72
 00000000`010ee820 000007fe`e1119079 : 00000000`0000020d 00000000`010ee9e0 00000000`00000000 00000000`00000001 : mfc120u!CView###OnPaint+0x5a
 00000000`010ee8e0 000007fe`e1118a68 : 00000000`0d949e90 00000000`00000000 00000000`00000000 00000000`00000001 : mfc120u!CWnd###OnWndMsg+0x5dd
 00000000`010eea60 000007fe`e1116422 : 00000000`00000000 00000000`01147a20 00000000`00000000 00000000`0d949e90 : mfc120u!CWnd###WindowProc+0x38
 00000000`010eeaa0 000007fe`e11167a4 : 00000000`0000000f 00000000`01f610d8 00000000`010eebb8 000007fe`e1130538 : mfc120u!AfxCallWndProc+0x10e
 00000000`010eeb50 000007fe`e0fd0a75 : 00000000`00000000 00000000`01f610d8 00000000`0000000f 000007fe`e1118a68 : mfc120u!AfxWndProc+0x54
 00000000`010eeb90 00000000`777e9bd1 : 00000000`00000000 00000001`3fb10000 00000000`00000000 00000000`01147a20 : mfc120u!AfxWndProcBase+0x51
 00000000`010eebe0 00000000`777e72cb : 00000000`00000000 000007fe`e0fd0a24 00000000`00000000 00000000`00000000 : USER32!UserCallWinProcCheckWow+0x1ad
 00000000`010eeca0 00000000`777e6829 : 000007fe`e127c2f8 000007fe`e0fe9662 00000000`01150760 00000000`01147a78 : USER32!DispatchClientMessage+0xc3
 00000000`010eed00 00000000`77a3dae5 : 00000000`00341dde 00000000`777e89fc 00016cec`0000001a 000007fe`e10c5731 : USER32!_fnDWORD+0x2d
 00000000`010eed60 00000000`777e6e5a : 00000000`777e6e6c 00000000`00000000 00000000`01147a20 00000000`01147a78 : ntdll!KiUserCallbackDispatcherContinue
 00000000`010eede8 00000000`777e6e6c : 00000000`00000000 00000000`01147a20 00000000`01147a78 000007fe`e11010e8 : USER32!NtUserDispatchMessage+0xa
 00000000`010eedf0 000007fe`e1100fb6 : 00000000`01147a78 00000000`01147a78 000007fe`e0fd0a24 00000000`00000000 : USER32!DispatchMessageWorker+0x55b
 00000000`010eee70 000007fe`e110180e : 00000001`3ff87800 00000001`3fb10000 00000000`00000000 00000000`00000000 : mfc120u!AfxInternalPumpMessage+0x52
 00000000`010eeea0 00000001`3fc6d1b1 : 00000001`3ff87800 00000001`3fb10000 00000000`00000000 00000000`0337df50 : mfc120u!CWinThread###Run+0x6e
 00000000`010eeee0 000007fe`e11300de : 00000000`0000000a 00000000`0000000a 00000000`00000000 00000000`010f3cda : NitroPDF!CxMemFile###Scanf+0xb11b1
 00000000`010ef9e0 00000001`3fda21a6 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`0000001f : mfc120u!AfxWinMain+0xa6
 00000000`010efa20 00000000`778e59cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NitroPDF!CxImageJPG###CxExifInfo###process_SOFn+0x71d96
 00000000`010efa60 00000000`77a1b891 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
 00000000`010efa90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d


 STACK_COMMAND:  .cxr 0x0 ; kb

 FOLLOWUP_IP:
 npdf!CxImage###~CxImage+9474d
 000007fe`da958c7d 410f114cc1f0    movups  xmmword ptr [r9+rax*8-10h],xmm1

 SYMBOL_STACK_INDEX:  0

 SYMBOL_NAME:  npdf!CxImage###~CxImage+9474d

 FOLLOWUP_NAME:  MachineOwner

 MODULE_NAME: npdf

 IMAGE_NAME:  npdf.dll

 DEBUG_FLR_IMAGE_TIMESTAMP:  5791f671

 FAILURE_BUCKET_ID:  APPLICATION_FAULT_c000041d_npdf.dll!CxImage###_CxImage

 BUCKET_ID:  X64_APPLICATION_FAULT_APPLICATION_FAULT_DETOURED_npdf!CxImage###_CxImage+9474d

 ANALYSIS_SOURCE:  UM

 FAILURE_ID_HASH_STRING:  um:application_fault_c000041d_npdf.dll!cximage###_cximage

 FAILURE_ID_HASH:  {2a602c9f-d2b3-eec9-a6ce-9d36a15b74b7}

 Followup: MachineOwner
 ---------

Timeline

2016-10-26 - Initial Discovery
2016-11-04 - Vendor Notification
2017-02-03 - Public Disclosure

Discovered by Piotr Bania of Cisco Talos.