Dear List, I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability. Check Point Software Technologies - Vulnerability Discovery Team (VDT) http://www.checkpoint.com/defense/ Apple CoreGraphics (Preview) Memory Corruption when parsing PDF files CVE-2010-1801 INTRODUCTION Apple Preview.app is the default application used in Apple MacOS systems in order to visualize PDF files and does not properly parse PDF files, which leads to memory corruption when opening a malformed file with an invalid size on JBIG2 structure at offset 0x2C1 as in PoC Repro1.pdf or offset 0x2C5 as in PoC Repro2.pdf (both values trigger the same vulnerability). This problem was confirmed in the following versions of Apple Preview and MacOS, other versions may be also affected. Apple Mac OS X 10.5.8 (Server as well) Apple Mac OS X 10.6.2 (Server as well) Apple Mac OS X 10.6.3 (Server as well) Apple Mac OS X 10.6.4 (Server as well) CVSS Scoring System The CVSS score is: 9 Base Score: 10 Temporal Score: 9 We used the following values to calculate the scores: Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C Temporal score is: E:POC/RL:U/RC:C TRIGGERING THE PROBLEM This vulnerability can be triggered by creating an invalid JBIG2 structure in two different ways. The problem is triggered by PoCs available to interested parts which causes invalid memory access in all the refered versions. DETAILS Changing offset 0x2C1: 0xdee8600 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3764>: xor %esi,%esi 0xdee8602 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3766>: mov -0x7c(%ebp),%edx 0xdee8605 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3769>: mov -0x118(%ebp),%eax 0xdee860b <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3775>: mov -0x7c(%ebp),%ecx 0xdee860e <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3778>: inc %edx 0xdee860f <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3779>: cmp 0x8(%eax),%ecx 0xdee8612 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3782>: jae 0xdee861a <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3790> 0xdee8614 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3784>: mov 0xc(%eax),%eax 0xdee8617 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3787>: mov %esi,(%eax,%edi,1) <----- Crash (gdb) i r $esi $eax $edi esi 0xc79e860 209315936 eax 0x0 0 edi 0x0 0 (gdb) bt #0 0x0dee8617 in JBIG2Stream::readSymbolDictSeg () #1 0x0dee4f0f in JBIG2Stream::readSegments () #2 0x0dee4b5e in JBIG2Stream::reset () #3 0x0dee499b in read_bytes () #4 0x96d33f32 in jbig2_filter_refill () #5 0x96a4b56c in CGPDFSourceRefill () #6 0x96a4b402 in CGPDFSourceRead () Changing offset 0x2C5: 0xdeb52dc <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2960>: inc %esp 0xdeb52dd <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2961>: and $0x4,%al 0xdeb52df <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2963>: add %al,(%eax) 0xdeb52e1 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2965>: add %al,(%eax) 0xdeb52e3 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2967>: mov %edx,(%esp) 0xdeb52e6 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2970>: call 0xdeb2a96 <_ZN11JBIG2Stream17readGenericBitmapEiiiiiiP11JBIG2BitmapPiS2_i> 0xdeb52eb <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2975>: mov -0x94(%ebp),%ecx 0xdeb52f1 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2981>: mov %eax,(%ecx) <----- Crash (gdb) i r $eax $ecx eax 0xc79b640 209303104 ecx 0x0 0 (gdb) bt #0 0x0deb52f1 in JBIG2Stream::readSymbolDictSeg () #1 0x0deb1f0f in JBIG2Stream::readSegments () #2 0x0deb1b5e in JBIG2Stream::reset () #3 0x0deb199b in read_bytes () #4 0x96d33f32 in jbig2_filter_refill () #5 0x96a4b56c in CGPDFSourceRefill () #6 0x96a4b402 in CGPDFSourceRead () #7 0x96aa3c8f in CGAccessSessionGetChunks () CREDITS This vulnerability was discovered and researched by Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team (VDT). Best Regards, Rodrigo. -- Rodrigo Rubira Branco Senior Security Researcher Vulnerability Discovery Team (VDT) Check Point Software Technologies
