Kaspersky AntiVirus – ‘.DEX’ File Format Memory Corruption

• Exploit Database
• 15 阅读

• 作者： Google Security Research
  日期： 2015-11-16
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/38735/

• Source: https://code.google.com/p/google-security-research/issues/detail?id=529
  
  The attached testcase was found by fuzzing DEX files, and results in a heap overflow with a wild memcpy. Note that Kaspersky catch exceptions and continue execution, so running into unmapped pages doesn't terminate the process, this should make exploitation quite realistic.
  
  (bb8.ac0): Access violation - code c0000005 (first chance)
  First chance exceptions are reported before any exception handling.
  This exception may be expected and handled.
  eax=0c0b2074 ebx=ffffffff ecx=3ffd419c edx=00000003 esi=0c161a01 edi=0c170000
  eip=72165157 esp=046ceed8 ebp=046ceee0 iopl=0 nv up ei pl nz na po nc
  cs=0023ss=002bds=002bes=002bfs=0053gs=002b efl=00010202
  avengine_dll!ekaGetObjectFactory+0x51537:
  72165157 f3a5rep movs dword ptr es:[edi],dword ptr [esi]
  0:023> dd edi
  0c170000???????? ???????? ???????? ????????
  0c170010???????? ???????? ???????? ????????
  0c170020???????? ???????? ???????? ????????
  0c170030???????? ???????? ???????? ????????
  0c170040???????? ???????? ???????? ????????
  0c170050???????? ???????? ???????? ????????
  0c170060???????? ???????? ???????? ????????
  0c170070???????? ???????? ???????? ????????
  0:023> dd esi
  0c161a0100000000 00000000 00000000 00000000
  0c161a1100000000 00000000 00000000 00000000
  0c161a2100000000 00000000 00000000 00000000
  0c161a3100000000 00000000 00000000 00000000
  0c161a4100000000 00000000 00000000 00000000
  0c161a5100000000 00000000 00000000 00000000
  0c161a6100000000 00000000 00000000 00000000
  0c161a7100000000 00000000 00000000 00000000
  0:023> kvn1
   # ChildEBP RetAddrArgs to Child
  00 046ceee0 15c01af7 0c0c0674 0c0b2075 ffffffff avengine_dll!ekaGetObjectFactory+0x51537
  
  This vulnerability is exploitable for remote code execution as NT AUTHORITY\SYSTEM.
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38735.zip