Microsoft Fax Cover Page Editor Double Free Vulnerability

vendor:

Fax Cover Page Editor

by:

Luigi Auriemma

7.8

CVSS

HIGH

Double Free

416

CWE

Product Name: Fax Cover Page Editor

Affected Version From: <= 5.2.3790.3959

Affected Version To: <= 5.2.3790.3959

Patch Exists: Yes

Related CWE: N/A

CPE: a:microsoft:fax_cover_page_editor

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2011

Microsoft Fax Cover Page Editor Double Free Vulnerability

fxscover.exe is available on Windows after the installation of the Fax Service. The various 'Text' elements have a 16bit field that seems used to index them and by default it has a negative value like 0x8001. By using a positive value major than 0 and lower than the total number of elements is possible to cause a problem during the freeing of the allocated object. The provided proof-of-concept demonstrates the possibility of executing code immediately after the acknoledgement of the initial message box when is called FXSCOVER!CDrawDoc::Remove by FXSCOVER!CDrawDoc::DeleteContents.

Mitigation:

Update to the latest version of Microsoft Fax Cover Page Editor.

Source

Exploit-DB raw data:

Source: http://aluigi.org/adv/fxscover_1-adv.txt

#######################################################################

                             Luigi Auriemma

Application:  Microsoft Fax Cover Page Editor
              http://windows.microsoft.com/en-US/windows-vista/Create-or-edit-a-fax-cover-page
Versions:     <= 5.2.3790.3959
Platforms:    Windows
Bug:          double free
Exploitation: local
Date:         19 Jan 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Fax Cover Page Editor is a program for the viewing and editing of
various formats of fax cover files.


#######################################################################

======
2) Bug
======


fxscover.exe is available on Windows after the installation of the Fax
Service.

The various "Text" elements have a 16bit field that seems used to index
them and by default it has a negative value like 0x8001.
By using a positive value major than 0 and lower than the total number
of elements is possible to cause a problem during the freeing of the
allocated object.

The provided proof-of-concept demonstrates the possibility of executing
code immediately after the acknoledgement of the initial message box
when is called FXSCOVER!CDrawDoc::Remove by
FXSCOVER!CDrawDoc::DeleteContents.

Modifications:
00005098   FE       CC  // code execution starts from here
000093F5   01       04  // 16bit in little endian
000093F6   80       00

Alternatively is also possible to exploit the bug when the program gets
closed or another file is opened by modifying the 16 bit at offset
0x94a5 instead of the one at 0x93f5, so that the file will be
considered valid.


#######################################################################

===========
3) The Code
===========

DoS:
http://aluigi.org/poc/fxscover_1.cov
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/16024-fxscover_1.cov

Bind Shell:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/fxscover_1_bind28876.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################