CVE-2013-3346Adobe Reader和Acrobat 内存损坏漏洞分析

　　　[CNNVD]Adobe Reader和Acrobat 内存损坏漏洞(CNNVD-201308-479)

Adobe Reader和Acrobat都是美国奥多比（Adobe）公司的产品。Adobe Reader是一款免费的PDF文件阅读器，Acrobat是一款PDF文件编辑和转换工具。
Adobe
Reader和Acrobat中存在安全漏洞。攻击者可利用该漏洞执行任意代码或造成拒绝服务（内存损坏）。以下版本受到影响：Adobe
Reader和Acrobat 9.5.5之前的9.x版本，10.1.7之前的10.x版本，11.0.03之前的11.x版本。

测试环境是Adobe Reader11+Windows 7。挂载调试器打开poc后程序异常退出，但是并未中断在调试器中，在任务管理器中发现Adobe Reader存在2个进程，于是启用子进程调试，重新加载，并中断在调试器中，信息如下。

eax= ebx= ecx=64f7f4ea edx=04bb1078 esi=3ef2cc90 edi=

eip=64f7e84b esp=0016e540 ebp=0016e564 iopl=         nv up ei pl nz ac po cy

cs=001b  ss=  ds=  es=  fs=003b  gs=             efl=

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader .\Reader\AcroRd32.dll -

AcroRd32!DllCanUnloadNow+0x150524:

64f7e84b 8b06            mov     eax,dword ptr [esi]  ds::3ef2cc90=????????

我们往前面看一下会发现esi来自ecx，而由于ecx就是this指针，这里怀疑是对象指针。再后面看一下又有call dword ptr [eax+364h]。于是重新加载启用堆分配记录。如下

:> !heap -p -a esi

    address 3eaeac90 found in

    _DPH_HEAP_ROOT @

    in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)

                                   3136171c:         3eaea000             0b2 verifier!AVrfDebugPageHeapFree+0x000000c2

     ntdll!RtlDebugFreeHeap+0x0000002f

    77737aca ntdll!RtlpFreeHeap+0x0000005d

    77702d68 ntdll!RtlFreeHeap+0x00000142

    768af1ac kernel32!HeapFree+0x00000014

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\MSVCR100.dll -

    6b41016a MSVCR100!free+0x0000001c

    627e1325 AcroRd32!CTJPEGLibInit+0x0000f6d5

    6290c2af AcroRd32!DllCanUnloadNow+0x0010df88

    628b3381 AcroRd32!DllCanUnloadNow+0x000b505a

    6294723b AcroRd32!DllCanUnloadNow+0x00148f14

    628980b1 AcroRd32!DllCanUnloadNow+0x00099d8a

    62e54bbf AcroRd32!CTJPEGRotateOptions::operator=+0x001b0aa3

    628980b1 AcroRd32!DllCanUnloadNow+0x00099d8a

    62cfabca AcroRd32!CTJPEGRotateOptions::operator=+0x00056aae

    62cfb275 AcroRd32!CTJPEGRotateOptions::operator=+0x00057159

    62cf93be AcroRd32!CTJPEGRotateOptions::operator=+0x000552a2

    62da391e AcroRd32!CTJPEGRotateOptions::operator=+0x000ff802

    62da3b7c AcroRd32!CTJPEGRotateOptions::operator=+0x000ffa60

    62da3eca AcroRd32!CTJPEGRotateOptions::operator=+0x000ffdae

*** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Reader .\Reader\plug_ins\Annots.api

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader .\Reader\plug_ins\Annots.api -

    64989a3a Annots!PlugInMain+0x00078015

    6498a692 Annots!PlugInMain+0x00078c6d

    6498af61 Annots!PlugInMain+0x0007953c

*** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Reader .\Reader\plug_ins\EScript.api

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader .\Reader\plug_ins\EScript.api -

    66e2a8e8 EScript!PlugInMain+0x000392b6

    66dfff65 EScript!PlugInMain+0x0000e933

    66e19749 EScript!PlugInMain+0x00028117

    66e157ec EScript!PlugInMain+0x000241ba

    66e378e6 EScript!PlugInMain+0x000462b4

    66e3786c EScript!PlugInMain+0x0004623a

    66e36951 EScript!PlugInMain+0x0004531f

    66e3626c EScript!PlugInMain+0x00044c3a

    66e342da EScript!PlugInMain+0x00042ca8

    64989e26 Annots!PlugInMain+0x00078401

很明显是已经释放的内存块，那我们来看下这个内存块是在哪里分配的。通过对分配函数下断向前摸到了这块内存的分配记录

:> !heap -p -a 04878de8

    address 04878de8 found in

    _DPH_HEAP_ROOT @ 45f1000

    in busy allocation (  DPH_HEAP_BLOCK:         UserAddr         UserSize -         VirtAddr         VirtSize)

                                 48f05e4:          4878de8               -

    77888e89 verifier!AVrfDebugPageHeapAllocate+0x00000229

    77774ea6 ntdll!RtlDebugAllocateHeap+0x00000030

    77737d96 ntdll!RtlpAllocateHeap+0x000000c4

    777034ca ntdll!RtlAllocateHeap+0x0000023a

    6b7709ee MSVCR100!unlock+0x000000ba

    6b771e32 MSVCR100!calloc_crt+0x00000016

    6b771d93 MSVCR100!mbtowc_l+0x000001be

    6b771e16 MSVCR100!mbtowc_l+0x00000241

    7770af24 ntdll!LdrpCallInitRoutine+0x00000014

    7770b511 ntdll!LdrpInitializeThread+0x0000015b

    7770b298 ntdll!_LdrpInitialize+0x000001ad

    7770b2c5 ntdll!LdrInitializeThunk+0x00000010

最后再看一下重用时的操作

:> kp

ChildEBP RetAddr

WARNING: Stack unwind information not available. Following frames may be wrong.

001fe028 64f7e0d2 AcroRd32!DllCanUnloadNow+0x150524

001fe04c 64f7f3e3 AcroRd32!DllCanUnloadNow+0x14fdab

001fe054 64f7d996 AcroRd32!DllCanUnloadNow+0x1510bc

001fe0a0 64f7c68c AcroRd32!DllCanUnloadNow+0x14f66f

001fe0d0 64f7c50e AcroRd32!DllCanUnloadNow+0x14e365

001fe160 64f7c206 AcroRd32!DllCanUnloadNow+0x14e1e7

001fe170 64f7c1a1 AcroRd32!DllCanUnloadNow+0x14dedf

001fe17c 64ed712e AcroRd32!DllCanUnloadNow+0x14de7a

001fe1a8 64f7ae0e AcroRd32!DllCanUnloadNow+0xa8e07

001fe1d8 64f76d1d AcroRd32!DllCanUnloadNow+0x14cae7

001fe1fc 64f76bf1 AcroRd32!DllCanUnloadNow+0x1489f6

001fe214 64f7434c AcroRd32!DllCanUnloadNow+0x1488ca

001fe2ac 64e2e440 AcroRd32!DllCanUnloadNow+0x146025

001fe2d8 64f73a64 AcroRd32!DllCanUnloadNow+0x119

001fe300 653d38ef AcroRd32!DllCanUnloadNow+0x14573d

001fe37c 653d3b7c AcroRd32!CTJPEGRotateOptions::operator=+0xff7d3

001fe390 653d3eca AcroRd32!CTJPEGRotateOptions::operator=+0xffa60

*** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Reader .\Reader\plug_ins\Annots.api

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader .\Reader\plug_ins\Annots.api -

001fe39c 63009a3a AcroRd32!CTJPEGRotateOptions::operator=+0xffdae

001fe3b0 6300a692 Annots!PlugInMain+0x78015

001fe3c8 6300af61 Annots!PlugInMain+0x78c6d

巴特西

CVE-2013-3346Adobe Reader和Acrobat 内存损坏漏洞分析

最新文章

热门文章