Talos Vulnerability Report

TALOS-2017-0289

Nitro Pro 11 PDF Handling Code Execution Vulnerability

July 6, 2017
CVE Number

CVE-2016-2796

Summary

An out of bound write vulnerability exists in the PDF parsing functionality of Nitro Pro 11.0.4.159. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.

Tested Versions

  • Nitro Pro 11.0.3.134 (Nitro PDF Library - 11, 0, 3, 134) - x64 version

Product URLs

http://gonitro.com

CVSSv3 Score

8.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

A remote memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption.

The vulnerable code is located in the npdf.dll library:

.text:0000000000268C20 loc_268C20:                             ; CODE XREF: sub_268BE0+A6j
.text:0000000000268C20                 movsxd  rax, dword ptr [r9+800h]
.text:0000000000268C27                 mov     rcx, rax
.text:0000000000268C2A                 add     rcx, rcx
.text:0000000000268C2D                 movups  xmm1, xmmword ptr [r9+rcx*8]
.text:0000000000268C32                 lea     ecx, [r10-1]
.text:0000000000268C36                 add     ecx, eax
.text:0000000000268C38                 cmp     eax, ecx
.text:0000000000268C3A                 jge     short write_bug
.text:0000000000268C3C                 mov     r8, rax
.text:0000000000268C3F                 shl     r8, 4
.text:0000000000268C43                 add     r8, r9
.text:0000000000268C46                 db      66h, 66h
.text:0000000000268C46                 nop     word ptr [rax+rax+00000000h]
.text:0000000000268C50
.text:0000000000268C50 loc_268C50:                             ; CODE XREF: sub_268BE0+8Ej
.text:0000000000268C50                 movups  xmm0, xmmword ptr [r8+10h]
.text:0000000000268C55                 inc     eax
.text:0000000000268C57                 lea     r8, [r8+10h]
.text:0000000000268C5B                 movups  xmmword ptr [r8-10h], xmm0
.text:0000000000268C60                 mov     edx, [r9+800h]
.text:0000000000268C67                 dec     edx
.text:0000000000268C69                 add     edx, r10d
.text:0000000000268C6C                 cmp     eax, edx
.text:0000000000268C6E                 jl      short loc_268C50
.text:0000000000268C70
.text:0000000000268C70 write_bug:                              ; CODE XREF: sub_268BE0+5Aj
.text:0000000000268C70                 movsxd  rax, dword ptr [r9+800h]
.text:0000000000268C77                 add     rax, r10
.text:0000000000268C7A                 add     rax, rax
.text:0000000000268C7D                 movups  xmmword ptr [r9+rax*8-10h], xmm1 ; * overwrite *
.text:0000000000268C83                 dec     r11
.text:0000000000268C86                 jnz     short loc_268C20

Memory access referred by selected instruction is presented below:

0x268C20 ### mem read addr=0xd447740   rax=[mem]=78 
0x268C2D ### mem read addr=0xd4476c0   xmm1=[mem]=2 
0x268C50 ### mem read addr=0xd4476d0   xmm0=[mem]=2 
0x268C5B ### mem write addr=d4476c0  [mem]=2 xmm0=2 
0x268C50 ### mem read addr=0xd4476e0   xmm0=[mem]=2 
0x268C5B ### mem write addr=d4476d0  [mem]=2 xmm0=2 
0x268C50 ### mem read addr=0xd4476f0   xmm0=[mem]=2 
0x268C5B ### mem write addr=d4476e0  [mem]=2 xmm0=2 
0x268C50 ### mem read addr=0xd447700   xmm0=[mem]=2 
0x268C5B ### mem write addr=d4476f0  [mem]=2 xmm0=2 
0x268C50 ### mem read addr=0xd447710   xmm0=[mem]=2 
0x268C5B ### mem write addr=d447700  [mem]=2 xmm0=2 
0x268C50 ### mem read addr=0xd447720   xmm0=[mem]=2 
0x268C5B ### mem write addr=d447710  [mem]=2 xmm0=2 
0x268C50 ### mem read addr=0xd447730   xmm0=[mem]=2 
0x268C5B ### mem write addr=d447720  [mem]=2 xmm0=2 
0x268C50 ### mem read addr=0xd447740   xmm0=[mem]=78 
0x268C5B ### mem write addr=d447730  [mem]=2 xmm0=78 
0x268C50 ### mem read addr=0xd447750   xmm0=[mem]=abababab 
0x268C5B ### mem write addr=d447740  [mem]=78 xmm0=abababab 
0x268C70 ### mem read addr=0xd447740   rax=[mem]=abababab 
0x268C7D ### mem write addr=c7ff2aa0  [mem]=Memory access error 

The last memory access (instruction at 0x268C7D) is causing the exception to trigger. The instruction at 0x268C7D is using the RAX register value to calculate the final memory address. RAX value is calculated by reading 32-bit memory from [r9+0x800] (with sign extension). Value at [r9+0x800] in this case is 0xABABABAB which is Microsoft's HeapAlloc() mark of "no man's land" guard bytes after the allocated heap memory. In other words this memory should be never referenced in the first place. This value is later increased by the r10 value (address 0x268C77) and multiplied by 2 (address 0x268C7A).

Crash Information

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for NitroPDF.exe - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for J:\nitro\Nitro_KissMetrics.dll - 

FAULTING_IP: 
npdf!CxImage###~CxImage+9474d
000007fe`da958c7d 410f114cc1f0    movups  xmmword ptr [r9+rax*8-10h],xmm1

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007feda958c7d (npdf!CxImage###~CxImage+0x000000000009474d)
   ExceptionCode: c000041d
  ExceptionFlags: 00000001
NumberParameters: 0

CONTEXT:  0000000000000000 -- (.cxr 0x0;r)
rax=ffffffff5757576e rbx=00000000010eaf80 rcx=0000000000000083
rdx=00000000abababb6 rsi=0000000077b31148 rdi=00000000010eb470
rip=000007feda958c7d rsp=00000000010eb690 rbp=000000000d9dff90
 r8=000000000db9b200  r9=000000000db9a9f0 r10=000000000000000c
r11=0000000000000003 r12=000000000d9c6d50 r13=000000000d9dfcb8
r14=00000000010ebf38 r15=000000000d94f8b0
iopl=0         nv up ei ng nz na pe cy
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010281
npdf!CxImage###~CxImage+0x9474d:
000007fe`da958c7d 410f114cc1f0    movups  xmmword ptr [r9+rax*8-10h],xmm1 ds:fffffffa`c8746550=????????????????????????????????

FAULTING_THREAD:  0000000000009ff4

DEFAULT_BUCKET_ID:  APPLICATION_FAULT

PROCESS_NAME:  NitroPDF.exe

ERROR_CODE: (NTSTATUS) 0xc000041d - Wyst

EXCEPTION_CODE: (NTSTATUS) 0xc000041d - Wyst

DETOURED_IMAGE: 1

NTGLOBALFLAG:  470

APPLICATION_VERIFIER_FLAGS:  0

APP:  nitropdf.exe

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

BUGCHECK_STR:  APPLICATION_FAULT_APPLICATION_FAULT

LAST_CONTROL_TRANSFER:  from 000007feda95754c to 000007feda958c7d

STACK_TEXT:  
    00000000`010eb690 000007fe`da95754c : 00000000`00003153 00000000`00000000 00000000`010f0200 00000000`010f3153 : npdf!  
CxImage###~CxImage+0x9474d
    00000000`010eb6a0 000007fe`da958ef5 : 00000000`0d9dff90 00000000`010ebd20 00000000`010ebc30 00000000`0d9c6d50 : npdf!  
CxImage###~CxImage+0x9301c
    00000000`010eb6f0 000007fe`da8a4729 : 00000000`0db80aa0 00000000`010ebd20 00000000`010ebc30 00000000`0d9dfcb8 : npdf!
CxImage###~CxImage+0x949c5
    00000000`010eb720 000007fe`da8452b9 : 00000000`010ebd20 00000000`0d9dfcb8 00000000`010ebc30 00000000`77a3ab58 : npdf!
TerminateApp+0xedfc9
    00000000`010eb750 000007fe`da8ceb01 : 00000000`010f0000 00000000`009c009a 00000000`0d9dfcb8 00000000`010ebc60 : npdf!
TerminateApp+0x8eb59
    00000000`010ebbd0 000007fe`da923daf : 00000000`00000060 00000000`0d9d7e08 00000000`00000001 00000000`010f0000 : npdf!
CxImage###~CxImage+0xa5d1
    00000000`010ebc20 000007fe`da93529b : 00000000`00000002 00000000`0d9d7e08 00000000`00000000 00000000`00000002 : npdf!  
CxImage###~CxImage+0x5f87f
    00000000`010ebeb0 000007fe`da8da4a8 : 00000000`00000002 00000000`00000000 00080000`00100081 000007fe`da700000 : npdf!
CxImage###~CxImage+0x70d6b
    00000000`010ec580 000007fe`da8dc0dc : 00000000`00000002 00000000`010ec700 00000000`00000002 00000000`0d9d7cd0 : npdf!
CxImage###~CxImage+0x15f78
    00000000`010ec600 000007fe`da8d2dc8 : 00000000`010f0000 00000000`0d9d7cd0 00000000`00000000 00000000`00000000 : npdf!
CxImage###~CxImage+0x17bac
    00000000`010ec7e0 000007fe`da8f68e0 : 00000000`0d9dfc80 00000000`010ee900 00000000`00000000 00000000`00000000 : npdf!
CxImage###~CxImage+0xe898
    00000000`010ecc60 000007fe`da8db70e : 00000000`0d9c6d50 00000000`0d9c6d50 00000000`0d9d7cd0 00000000`0d9dd660 : npdf!
CxImage###~CxImage+0x323b0
    00000000`010ed170 000007fe`da823752 : 00000000`0d9d7cd0 00000000`047e8040 0409001f`00000000 00000000`0d950780 : npdf!
CxImage###~CxImage+0x171de
    00000000`010ed6a0 000007fe`da824d45 : 00000000`0d950590 000007fe`fedf6a47 00000000`00000000 000007fe`fedf6941 : npdf!
TerminateApp+0x6cff2
    00000000`010edc30 00000001`3fc29bbc : 00000000`00000000 00000000`0d950590 00000000`010ee9e0 00000000`0d950590 : npdf!
TerminateApp+0x6e5e5
    00000000`010edc80 00000001`3fc2ec72 : 00000000`0d949e90 00000000`00000404 00000000`0d94a408 00000000`010ee9e0 : NitroPDF!
CxMemFile###Scanf+0x6dbbc
    00000000`010ee370 000007fe`e1104b26 : 00000000`010ee850 00000000`010ee888 00000000`0d949e90 000007fe`fedf1169 : NitroPDF!
CxMemFile###Scanf+0x72c72
    00000000`010ee820 000007fe`e1119079 : 00000000`0000020d 00000000`010ee9e0 00000000`00000000 00000000`00000001 : mfc120u!
CView###OnPaint+0x5a
    00000000`010ee8e0 000007fe`e1118a68 : 00000000`0d949e90 00000000`00000000 00000000`00000000 00000000`00000001 : mfc120u!
CWnd###OnWndMsg+0x5dd
    00000000`010eea60 000007fe`e1116422 : 00000000`00000000 00000000`01147a20 00000000`00000000 00000000`0d949e90 : mfc120u!
CWnd###WindowProc+0x38
    00000000`010eeaa0 000007fe`e11167a4 : 00000000`0000000f 00000000`01f610d8 00000000`010eebb8 000007fe`e1130538 : mfc120u!
AfxCallWndProc+0x10e
    00000000`010eeb50 000007fe`e0fd0a75 : 00000000`00000000 00000000`01f610d8 00000000`0000000f 000007fe`e1118a68 : mfc120u!A     
fxWndProc+0x54
    00000000`010eeb90 00000000`777e9bd1 : 00000000`00000000 00000001`3fb10000 00000000`00000000 00000000`01147a20 : 
mfc120u!AfxWndProcBase+0x51
    00000000`010eebe0 00000000`777e72cb : 00000000`00000000 000007fe`e0fd0a24 00000000`00000000 00000000`00000000 : 
USER32!UserCallWinProcCheckWow+0x1ad
    00000000`010eeca0 00000000`777e6829 : 000007fe`e127c2f8 000007fe`e0fe9662 00000000`01150760 00000000`01147a78 : 
USER32!DispatchClientMessage+0xc3
    00000000`010eed00 00000000`77a3dae5 : 00000000`00341dde 00000000`777e89fc 00016cec`0000001a 000007fe`e10c5731 : 
USER32!_fnDWORD+0x2d
    00000000`010eed60 00000000`777e6e5a : 00000000`777e6e6c 00000000`00000000 00000000`01147a20 00000000`01147a78 : 
ntdll!KiUserCallbackDispatcherContinue
    00000000`010eede8 00000000`777e6e6c : 00000000`00000000 00000000`01147a20 00000000`01147a78 000007fe`e11010e8 : 
USER32!NtUserDispatchMessage+0xa
    00000000`010eedf0 000007fe`e1100fb6 : 00000000`01147a78 00000000`01147a78 000007fe`e0fd0a24 00000000`00000000 : 
USER32!DispatchMessageWorker+0x55b
    00000000`010eee70 000007fe`e110180e : 00000001`3ff87800 00000001`3fb10000 00000000`00000000 00000000`00000000 : 
mfc120u!AfxInternalPumpMessage+0x52
    00000000`010eeea0 00000001`3fc6d1b1 : 00000001`3ff87800 00000001`3fb10000 00000000`00000000 00000000`0337df50 :   
mfc120u!CWinThread###Run+0x6e
    00000000`010eeee0 000007fe`e11300de : 00000000`0000000a 00000000`0000000a 00000000`00000000 00000000`010f3cda : 
NitroPDF!CxMemFile###Scanf+0xb11b1
    00000000`010ef9e0 00000001`3fda21a6 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`0000001f : 
mfc120u!AfxWinMain+0xa6
    00000000`010efa20 00000000`778e59cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 
NitroPDF!CxImageJPG###CxExifInfo###process_SOFn+0x71d96
    00000000`010efa60 00000000`77a1b891 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 
kernel32!BaseThreadInitThunk+0xd
    00000000`010efa90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 
ntdll!RtlUserThreadStart+0x1d


STACK_COMMAND:  .cxr 0x0 ; kb

FOLLOWUP_IP: 
npdf!CxImage###~CxImage+9474d
000007fe`da958c7d 410f114cc1f0    movups  xmmword ptr [r9+rax*8-10h],xmm1

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  npdf!CxImage###~CxImage+9474d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: npdf

IMAGE_NAME:  npdf.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5791f671

FAILURE_BUCKET_ID:  APPLICATION_FAULT_c000041d_npdf.dll!CxImage###_CxImage

BUCKET_ID:  X64_APPLICATION_FAULT_APPLICATION_FAULT_DETOURED_npdf!CxImage###_CxImage+9474d

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:application_fault_c000041d_npdf.dll!cximage###_cximage

FAILURE_ID_HASH:  {2a602c9f-d2b3-eec9-a6ce-9d36a15b74b7}

Followup: MachineOwner
---------

Timeline

2017-02-22 - Vendor Disclosure
2017-07-07 - Public Release

Credit

Discovered by Piotr Bania of Cisco Talos.