FFDshow SEH Exception leading to NULL pointer on Read

vendor:

FFDshow

by:

Matthew Bergin

9,3

CVSS

HIGH

SEH Exception leading to NULL pointer on Read

119

CWE

Product Name: FFDshow

Affected Version From: v1.1.3530.0

Affected Version To: v1.1.3530.0

Patch Exists: YES

Related CWE: N/A

CPE: a:ffdshow:ffdshow

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2010

FFDshow SEH Exception leading to NULL pointer on Read

FFDshow is vulnerable to a SEH Exception leading to a NULL pointer on Read. This vulnerability is caused by a stack-based buffer overflow in the ffdshow.ax module. When a specially crafted media file is opened, an attacker can overwrite the SEH chain and control the execution flow of the application. This can lead to arbitrary code execution.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should update to the latest version of FFDshow.

Source

Exploit-DB raw data:

FFDshow SEH Exception leading to NULL pointer on Read
Author: Matthew Bergin
Website: http://berginpentesting.com/
Email: matt@berginpentesting.com
Date: 09/02/10
Filename: C:\Program Files\K-Lite Codec Pack\FFDshow\ffdshow.ax
Version: v1.1.3530.0
License: GNU General Public License

Description


Crash Instructions
kernel32.7c812afb 5E 			POP ESI ffdshow.02659580 <- Exception E06d7363
kernel32.7c812afc C9 			LEAVE
kernel32.7c812afd C2 1000		RETN 10
ffdshow.0261a804  C9			LEAVE
ffdshow.0261a805  C2 0800		RETN 8
ffdshow.023cc407  8b45 08		MOV EAX, DWORD PTR SS:[EBP+8]
ffdshow.023cc4da  50			PUSH EAX			ffdshow.026fbe9c
ffdshow.023cc4db  E8 70FEFFFF		CALL ffdshow.023cc350
ffdshow.023cc350  55			PUSH EBP
ffdshow.023cc351  8BEC			MOV EBP,ESP
ffdshow.023cc353  6A FF			PUSH -1
ffdshow.023cc355  68 C1826402		PUSH ffdshow.026482c1
ffdshow.023cc35a  61:A1 00000000	MOV EAX, DWORD PTR FS:[0]
ffdshow.023cc360  50			PUSH EAX
ffdshow.023cc361  64:8925 00000000      MOV DWORD PTR FS:[0], ESP
ffdshow.023CC368  83EC 1C          	SUB ESP,1C
ffdshow.023CC36B  53               	PUSH EBX
ffdshow.023CC36C  33C0             	XOR EAX,EAX
ffdshow.023CC36E  56               	PUSH ESI
ffdshow.023CC36F  8945 EC          	MOV DWORD PTR SS:[EBP-14],EAX
ffdshow.023CC372  57               	PUSH EDI
ffdshow.023CC373  8B7D 08          	MOV EDI,DWORD PTR SS:[EBP+8]
ffdshow.023CC376  8907             	MOV DWORD PTR DS:[EDI],EAX
ffdshow.023CC378  8965 F0          	MOV DWORD PTR SS:[EBP-10],ESP
ffdshow.023CC37B  8947 04          	MOV DWORD PTR DS:[EDI+4],EAX
ffdshow.023CC37E  8D45 E4          	LEA EAX,DWORD PTR SS:[EBP-1C]
ffdshow.023CC381  BB 01000000      	MOV EBX,1
ffdshow.023CC386  50               	PUSH EAX
ffdshow.023CC387  895D EC          	MOV DWORD PTR SS:[EBP-14],EBX
ffdshow.023CC38A  895D FC          	MOV DWORD PTR SS:[EBP-4],EBX
ffdshow.023CC38D  E8 EEFDFFFF      	CALL ffdshow.023CC180
...
...
ffdshow.023CC19E  33C0       	      	XOR EAX,EAX
ffdshow.023CC1A0  8965 F0       	MOV DWORD PTR SS:[EBP-10],ESP
ffdshow.023CC1A3  50              	PUSH EAX
ffdshow.023CC1A4  50               	PUSH EAX
ffdshow.023CC1A5  8945 EC          	MOV DWORD PTR SS:[EBP-14],EAX
ffdshow.023CC1A8  8945 FC          	MOV DWORD PTR SS:[EBP-4],EAX
ffdshow.023CC1AB  E8 0CE62400      	CALL ffdshow.0261A7BC
ffdshow.023CC1B0  8B4D E8          	MOV ECX,DWORD PTR SS:[EBP-18]
ffdshow.023CC1B3  8B01             	MOV EAX,DWORD PTR DS:[ECX] <- Access Violation when reading 00000000 NULL pointer
ffdshow.023CC1B5  8B10             	MOV EDX,DWORD PTR DS:[EAX]
ffdshow.023CC1B7  FFD2             	CALL EDX


Crash Registers on Exception
EAX 01d0db3c
ECX 00000000
EDX 01d0dbe0
EBX 00000000
ESP 01d0db38
EBP 01d0db8c
ESI 01d0dbc4
EDI 00000000
EIP 7c812afb kernel32.7c812afb


Crash Registers on Violation
EAX 01d0da8c
ECX 00000000
EDX 01d0dbe0
EBX 00000001
ESP 01d0db24
EBP 01d0db88
ESI 02659580 ffdshow.02659580
EDI 026fbe9c ffdshow.026fbe9c
EIP 023cc1b3 ffdshow.023cc1b3


Stack
01D0DBD0  |026FBE9C  ffdshow.026FBE9C
01D0DBD4  |00000000
01D0DBD8  |02659580  ffdshow.02659580
01D0DBDC  |00000000
01D0DBE0  |0265B7E4  ffdshow.0265B7E4
01D0DBE4  |00000000
01D0DBE8  |0265BC88  ASCII "boost::current_exception()"
01D0DBEC  |0265BC58  ASCII "src\boost/exception/detail/exception_ptr.hpp"
01D0DBF0  |00000050
01D0DBF4  |0265B7D8  ffdshow.0265B7D8
01D0DBF8  |0265B544  ASCII "bad allocation"
01D0DBFC  |00000000
01D0DC00  |0265B8C4  ffdshow.0265B8C4
01D0DC04  |00000000
01D0DC08  |01D0DBD4
01D0DC0C  |01D0DC50  Pointer to next SEH record
01D0DC10  |026482D0  SE handler
01D0DC14  |00000000
01D0DC18  ]01D0DC6C
01D0DC1C  |023CC5A4  RETURN to ffdshow.023CC5A4 from ffdshow.023CC490
01D0DC20  |026FBE9C  ffdshow.026FBE9C
01D0DC24  |01D0DC30
01D0DC28  |023B0000  ffdshow.023B0000
01D0DC2C  |00000000
01D0DC30  |0265B7C4  ffdshow.0265B7C4
01D0DC34  |00000000
01D0DC38  |0265BC88  ASCII "boost::current_exception()"
01D0DC3C  |0265BC58  ASCII "src\boost/exception/detail/exception_ptr.hpp"
01D0DC40  |00000050
01D0DC44  |0265B7CC  ffdshow.0265B7CC
01D0DC48  |0265B544  ASCII "bad allocation"
01D0DC4C  |00000000
01D0DC50  |01D0DCBC  Pointer to next SEH record
01D0DC54  |026482FE  SE handler


Reproduction
Use attached PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14882.rar (FFDshowSEHExceptionleadingtoNULLpointeronRead.rar)