#######################################################################

                             Luigi Auriemma

Application:  GenStat
              http://www.vsni.co.uk/software/genstat/
Versions:     <= 14.1.0.5943
Platforms:    Windows
Bugs:         A] array overflow with write2
              B] heap overflow
Exploitation: file
Date:         01 Oct 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"all embracing data analysis tool, offering ease of use via our
comprehensive menu system reinforced with the flexibility of a
sophisticated programming language."
"For over 30 years we have employed, and continue to work with, leading
statisticians and scientists who help to create a package that succeeds
for both novice and expert users in academia, research and industry."


#######################################################################

=======
2) Bugs
=======

-----------------------------
A] array overflow with write2
-----------------------------

Array overflow during the handling of the GWB (GenStat book) files with
possibility of placing a NULL word in an arbitrary memory location:

  00630399  |> 8B46 24        MOV EAX,DWORD PTR DS:[ESI+24] ; EAX controlled
  0063039C  |. 8B4E 08        MOV ECX,DWORD PTR DS:[ESI+8]
  0063039F  |. 8D0481         LEA EAX,DWORD PTR DS:[ECX+EAX*4]
  006303A2  |. 3938           CMP DWORD PTR DS:[EAX],EDI
  006303A4  |. 74 12          JE SHORT GenStat.006303B8
  006303A6  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
  006303A8  |. 05 A4040000    ADD EAX,4A4
  006303AD  |. 0FB708         MOVZX ECX,WORD PTR DS:[EAX]
  006303B0  |. 894D FC        MOV DWORD PTR SS:[EBP-4],ECX
  006303B3  |. 33C9           XOR ECX,ECX
  006303B5  |. 66:8908        MOV WORD PTR DS:[EAX],CX      ; write2


----------------
B] heap overflow
----------------

Through the text strings in the final part of the GSH (GenStat
SpreadSheet) files it's possible to cause a heap overflow with
consequent freeing of arbitrary memory (write4):

  0064D1C7  |> 3BBE 78040000 /CMP EDI,DWORD PTR DS:[ESI+478]
  0064D1CD  |. 7F 74         |JG SHORT GenStat.0064D243
  0064D1CF  |. FF75 08       |PUSH DWORD PTR SS:[EBP+8]
  0064D1D2  |. 8D45 F4       |LEA EAX,DWORD PTR SS:[EBP-C]
  0064D1D5  |. 6A 01         |PUSH 1
  0064D1D7  |. 6A 04         |PUSH 4
  0064D1D9  |. 50            |PUSH EAX
  0064D1DA  |. E8 2F3B2600   |CALL GenStat.008B0D0E             ; read 32bit
  0064D1DF  |. 83C4 10       |ADD ESP,10
  0064D1E2  |. 85C0          |TEST EAX,EAX
  0064D1E4  |.^0F84 06FFFFFF |JE GenStat.0064D0F0
  0064D1EA  |. 66:837D 0C 00 |CMP WORD PTR SS:[EBP+C],0
  0064D1EF  |. 74 0A         |JE SHORT GenStat.0064D1FB
  0064D1F1  |. 8D45 F4       |LEA EAX,DWORD PTR SS:[EBP-C]
  0064D1F4  |. 50            |PUSH EAX
  0064D1F5  |. E8 DD6AFFFF   |CALL GenStat.00643CD7
  0064D1FA  |. 59            |POP ECX
  0064D1FB  |> 837D F4 00    |CMP DWORD PTR SS:[EBP-C],0
  0064D1FF  |. 7E 1E         |JLE SHORT GenStat.0064D21F        ; I use the first one equal to -1
  0064D201  |. FF75 08       |PUSH DWORD PTR SS:[EBP+8]
  0064D204  |. 8B46 58       |MOV EAX,DWORD PTR DS:[ESI+58]
  0064D207  |. 6A 01         |PUSH 1
  0064D209  |. FF75 F4       |PUSH DWORD PTR SS:[EBP-C]         ; 0x61616161
  0064D20C  |. 03C7          |ADD EAX,EDI
  0064D20E  |. 50            |PUSH EAX
  0064D20F  |. E8 FA3A2600   |CALL GenStat.008B0D0E             ; overflow/corruption
  0064D214  |. 83C4 10       |ADD ESP,10
  0064D217  |. 85C0          |TEST EAX,EAX
  0064D219  |.^0F84 D1FEFFFF |JE GenStat.0064D0F0
  0064D21F  |> FF86 74040000 |INC DWORD PTR DS:[ESI+474]
  0064D225  |. 8B45 F4       |MOV EAX,DWORD PTR SS:[EBP-C]
  0064D228  |. 43            |INC EBX
  0064D229  |. 3B5D F8       |CMP EBX,DWORD PTR SS:[EBP-8]
  0064D22C  |. 8D7C07 01     |LEA EDI,DWORD PTR DS:[EDI+EAX+1]  ; 0 + -1 + 1 = 0
  0064D230  |.^7C 95         \JL SHORT GenStat.0064D1C7


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/genstat_1.zip

A] modified 32bit field at offset 0x46
B] modified 32bit field at offset 0x302 and added 'a's


#######################################################################

======
4) Fix
======


No fix.


#######################################################################