← Advisories

Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC

Medium
Advisory ID
ZSL-2011-5012
Release Date
12 May 2011
Vendor
Adobe Systems Incorporated - http://www.adobe.com
Affected Version
3.0 (build 7283)
Tested On
Microsoft Windows XP Professional SP3 (EN)
Summary

Recording, mixing, editing, and mastering — Adobe® Audition® 3 software is the all-in-one toolset for professional audio production.

Description

Adobe Audition suffers from a buffer overflow vulnerability when dealing with .SES (session) format file. The application failz to sanitize the user input resulting in a memory corruption, overwriting several memory registers which can aid the atacker to gain the power of executing arbitrary code or denial of service.

(748.b94): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=0321e008 ebx=04386810 ecx=03210478 edx=00000000 esi=00000003 edi=0439080c eip=0321048b esp=0010e084 ebp=0010e1d8 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202 +0x321045a: 0321048b 038804210390 add ecx,dword ptr [eax-6FFCDEFCh] ds:0023:9325010c=???????? 0:000> g (748.b94): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000000 ebx=00000000 ecx=00000000 edx=0438cd88 esi=00000009 edi=00000000 eip=075a20f5 esp=0010dec8 ebp=0010e014 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Audition 3.0\en_US\PlayerStandard.prm *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Adobe\Adobe Audition 3.0\en_US\PlayerStandard.prm - PlayerStandard!xPlayEntry+0x7785: 075a20f5 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00000004=???????? 0:000> g <2964> <Assert> <0> Unhandled Exception caught! <2964> <Assert> <0> plugin.PrPlayModule playmod:0x0 Threw an unknown EXCEPTION during selector:2 ThreadName: PremiereMain ThreadID: 2964 CurrentModule: C:\Program Files\Adobe\Adobe Audition 3.0\en_US\PlayerStandard.prm Press 'debug' to re-throw the exception (usually to the debugger). (748.b94): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=07b13a90 ebx=00000000 ecx=04387c90 edx=02cf0608 esi=04387cb8 edi=0438ea98 eip=00978b0e esp=0010e1fc ebp=0010e2d0 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206 *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Audition 3.0\MediaLayer.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Adobe\Adobe Audition 3.0\MediaLayer.dll - MediaLayer!AlphaToGreyBuffer+0x69d11: 00978b0e 8b08 mov ecx,dword ptr [eax] ds:0023:07b13a90=???????? 0:000> g eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=7c90de50 edi=00000003 eip=7c90e4f4 esp=0010e5f0 ebp=0010e6ec iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!KiFastSystemCallRet: 7c90e4f4 c3 ret
Proof of Concept
Disclosure Timeline
18.09.2009Vulnerability discovered.
09.03.2010Vendor contacted with sent PoC files.
21.03.2010Another e-mail sent to vendor asking for verification.
21.03.2010Vendor replies asking to re-send the details stating that the 1st e-mail didn't reach them.
22.03.2010Sent vulnerability details and PoC files to vendor.
22.03.2010Vendor confirms the e-mail arrival and looking into the issue.
17.07.2010Sent e-mail to vendor for information update.
20.07.2010Vendor confirms vulnerability, promising a fix.
25.09.2010Vendor works on schedule update release stating discontinuation of .SES format.
09.05.2011Vendor reveals patch release date.
12.05.2011Coordinated public security advisory release.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
12.05.2011Initial release
13.05.2011Added reference [3], [4], [5], [6] and [7]
14.05.2011Added reference [8]
16.05.2011Added reference [9] and [10]
17.05.2011Added reference [11]
22.05.2011Added reference [12] and [13]
23.05.2011Added reference [14]