RealNetworks RealPlayer文件解析函数多个漏洞

RealPlayer是一款流行的媒体播放程序。 RealPlayer解析特殊构建的文件存在多个内存破坏问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 -当解析特殊构建的.mov文件，存在如下有问题代码： --//- snip ----//----------------------------------------------------- 62448F24 8B4D E2 MOV ECX,DWORD PTR SS:[EBP-1E] ; (*1) 62448F27 8B45 DE MOV EAX,DWORD PTR SS:[EBP-22] 62448F2A 2BC1 SUB EAX,ECX ; (*2) 62448F2C 8B53 17 MOV EDX,DWORD PTR DS:[EBX+17] 62448F2F 8D3401 LEA ESI,DWORD PTR DS:[ECX+EAX] 62448F32 8975 FC MOV DWORD PTR SS:[EBP-4],ESI 62448F35 3932 CMP DWORD PTR DS:[EDX],ESI 62448F37 0F82 C2000000 JB rvrender.62448FFF 62448F3D 8B75 DD MOV ESI,DWORD PTR SS:[EBP-23] 62448F40 81E6 FF000000 AND ESI,0FF 62448F46 3972 14 CMP DWORD PTR DS:[EDX+14],ESI 62448F49 0F85 B0000000 JNZ rvrender.62448FFF 62448F4F 8B75 DC MOV ESI,DWORD PTR SS:[EBP-24] 62448F52 81E6 FF000000 AND ESI,0FF 62448F58 837CF2 10 00 CMP DWORD PTR DS:[EDX+ESI*8+10],0 62448F5D 0F85 9C000000 JNZ rvrender.62448FFF 62448F63 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 62448F66 0377 04 ADD ESI,DWORD PTR DS:[EDI+4] 62448F69 8B7A 04 MOV EDI,DWORD PTR DS:[EDX+4] ; (*3) 62448F6C 8BD1 MOV EDX,ECX 62448F6E 03F8 ADD EDI,EAX ; (*4) 62448F70 C1E9 02 SHR ECX,2 62448F73 F3:A5 REP MOVSD ; memcpy() (*5) --//- snip ----//----------------------------------------------------- 攻击者可以在0x62448F24 (*1)初始化的ECX寄存器值，此值在之后用于EDI寄存器初始化(memcpy() (*5)的目的数据)，也用于memcpy() (*5)操作的大小参数。 EAX寄存器内容看起来是个0x326的常数值，并使用如下操作：EAX = 0x326 - ECX(*1)，到此EAX值维持不变。 在(*3)出会看到EDI寄存器初始化，这里会指向分配堆内存块之内(父块大小一直等于0xa8000)。在EDI初始化后它使用EAX值规格化，在(*2)处建立。 这可导致一个明显的内存破坏，攻击者可以控制ECX和EDI寄存器，表示可以控制拷贝内存时的目的地址和大小，可发生以应用程序权限执行任意指令。 -另外在处理特殊的.mov文件时，下面代码也存在问题： --//- snip ----//----------------------------------------------------- 62A70598 8A47 05 MOV AL,BYTE PTR DS:[EDI+5] ; al=controled by attacker 62A7059B 8A67 04 MOV AH,BYTE PTR DS:[EDI+4] ; ah=controled by attacker 62A7059E 66:3B86 AE000000 CMP AX,WORD PTR DS:[ESI+AE] ; below 2? 62A705A5 73 11 JNB SHORT 62A705B8 ; not signed compare, assume:taken! 62A705A7 8B8E B0000000 MOV ECX,DWORD PTR DS:[ESI+B0] 62A705AD 25 FFFF0000 AND EAX,0FFFF 62A705B2 66:8B0441 MOV AX,WORD PTR DS:[ECX+EAX*2] 62A705B6 EB 05 JMP SHORT 62A705BD 62A705B8 B8 FFFF0000 MOV EAX,0FFFF ; eax=0xFFFF 62A705BD 33D2 XOR EDX,EDX ; edx=0 62A705BF 33C9 XOR ECX,ECX ; ecx=0 62A705C1 8A77 06 MOV DH,BYTE PTR DS:[EDI+6] ; dh=controled by attacker 62A705C4 8A6F 08 MOV CH,BYTE PTR DS:[EDI+8] ; ch=controled by attacker 62A705C7 8A57 07 MOV DL,BYTE PTR DS:[EDI+7]` ; dl=controled by attacker 62A705CA 81E1 FFFF0000 AND ECX,0FFFF ; leave only CX value 62A705D0 C1E2 10 SHL EDX,10 ; rotation high(edx)&lt;-dx 62A705D3 0BD1 OR EDX,ECX ; power up the bits given by ecx 62A705D5 33C9 XOR ECX,ECX ; ecx=0 62A705D7 8A4F 09 MOV CL,BYTE PTR DS:[EDI+9] ; cl=controled by attacker 62A705DA 0BD1 OR EDX,ECX ; power up some bits... 62A705DC 8B8E 8A000000 MOV ECX,DWORD PTR DS:[ESI+8A] 62A705E2 85C9 TEST ECX,ECX ; ecx=0? =&gt; take the jump 62A705E4 74 0F JE SHORT 62A705F5 62A705E6 3956 48 CMP DWORD PTR DS:[ESI+48],EDX 62A705E9 76 0A JBE SHORT 62A705F5 62A705EB C786 8E000000 01&gt;MOV DWORD PTR DS:[ESI+8E],1 62A705F5 8956 48 MOV DWORD PTR DS:[ESI+48],EDX ; store edx 62A705F8 8B8E 8A000000 MOV ECX,DWORD PTR DS:[ESI+8A] ; ecx = 0 62A705FE 41 INC ECX ; ecx++ 62A705FF 25 FFFF0000 AND EAX,0FFFF ; leave the AX value (0xffff) 62A70604 898E 8A000000 MOV DWORD PTR DS:[ESI+8A],ECX ; [esi+0x8a]=1 62A7060A 8BC8 MOV ECX,EAX ; ecx=0xffff 62A7060C C1E0 05 SHL EAX,5 ; eax=0x1FFFE0 (rotated) 62A7060F 2BC1 SUB EAX,ECX ; eax-0xffff = 0x1EFFE1 62A70611 8B8E 9A000000 MOV ECX,DWORD PTR DS:[ESI+9A] ; ecx=heap mem 62A70617 D1E0 SHL EAX,1 ; eax=0x003DFFC2 62A70619 03C8 ADD ECX,EAX ; ecx=ecx+eax (memory location) 62A7061B 8379 36 00 CMP DWORD PTR DS:[ECX+36],0 62A7061F 75 1F JNZ SHORT 62A70640 62A70621 8951 24 MOV DWORD PTR DS:[ECX+24],EDX ; ** corruption ** --//- snip ----//----------------------------------------------------- 0x62A70621处的指令存在EDX寄存器的值(受攻击者控制)到[ECX+0x24]处，[ECX+0x24]的值没有完全受攻击者控制，但当0x62A7059E处的AX值低于2此值会轮循。如果[ECX+0x24]的内存中包含RealPlayer的重要数据，可导致覆盖攻击者指定的值而导致安全问题。成功利用漏洞可导致以应用程序进程权限执行任意指令。 -另外处理恶意.mp3, rm, .swf, .ram, .pls存在对个堆栈或堆溢出问题。目前没有详细漏洞细节提供。 Real Networks RealPlayer Enterprise Real Networks RealPlayer 8 Real Networks RealPlayer 10 for Mac OS 10.0 481 Real Networks RealPlayer 10 for Mac OS 10.0 412 Real Networks RealPlayer 10 for Mac OS 10.0 396 Real Networks RealPlayer 10 for Mac OS 10.0 352 Real Networks RealPlayer 10 for Mac OS 10.0 .0.331 Real Networks RealPlayer 10 for Mac OS 10.0.0.325 Real Networks RealPlayer 10 for Mac OS 10.0.0.305 Real Networks RealPlayer 10 for Linux 10.0.8 Real Networks RealPlayer 10 for Linux 10.0.7 Real Networks RealPlayer 10 for Linux 10.0.6 Real Networks RealPlayer 10 for Linux 10.0.5 Real Networks RealPlayer 10.5 Real Networks RealPlayer 10.0 + S.u.S.E. cvsup-16.1h-43.i586.rpm + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 Real Networks RealOne Player for Mac 0 Real Networks RealOne Player 2.0 Real Networks RealOne Player 1.0 Real Networks Helix Player for Linux 10.0.7 Real Networks Helix Player for Linux 10.0.6 Real Networks Helix Player for Linux 10.0.5 Real Networks Helix Player for Linux 10.0 8 升级到最新版本： <a href="http://service.real.com/realplayer/security/10252007_player/en/" target="_blank">http://service.real.com/realplayer/security/10252007_player/en/</a>