#######################################################################

                             Luigi Auriemma

Application:  Microsoft Reader
              http://www.microsoft.com/reader
Versions:     <= 2.1.1.3143 (PC version)
              <= 2.6.1.7169 (Origami version)
              the non-PC versions have not been tested
Platforms:    Windows, Windows Mobile, Tablet PC and UMPC devices
Bug:          integer overflow
Date:         11 Apr 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Microsoft Reader is a software needed to read and catalog the ebooks in
LIT format and the Audible audio books bought via internet, indeed the
homepage acts also as online store for these protected contents.


#######################################################################

======
2) Bug
======


Heap overflow caused by controlled memmove:

  0107100D  /$ 55             PUSH EBP
  0107100E  |. 8BEC           MOV EBP,ESP
  01071010  |. 83EC 38        SUB ESP,38
  01071013  |. 8B45 08        MOV EAX,DWORD PTR SS:[EBP+8]
  01071016  |. 53             PUSH EBX
  01071017  |. 8B5D 14        MOV EBX,DWORD PTR SS:[EBP+14]
  0107101A  |. 56             PUSH ESI
  0107101B  |. 8B40 20        MOV EAX,DWORD PTR DS:[EAX+20]
  0107101E  |. 57             PUSH EDI
  0107101F  |. 3B58 2C        CMP EBX,DWORD PTR DS:[EAX+2C]
  01071022  |. 72 07          JB SHORT msreader.0107102B
  01071024  |. 33C0           XOR EAX,EAX
  01071026  |. E9 38020000    JMP msreader.01071263
  0107102B  |> 8BF3           MOV ESI,EBX
  0107102D  |. 8B40 20        MOV EAX,DWORD PTR DS:[EAX+20]     ; 0x00002000
  01071030  |. C1E6 05        SHL ESI,5
  01071033  |. 0375 10        ADD ESI,DWORD PTR SS:[EBP+10]
  01071036  |. 83E8 10        SUB EAX,10                        ; 0x00001ff0
  01071039  |. 8945 F0        MOV DWORD PTR SS:[EBP-10],EAX
  0107103C  |. 8B7E 08        MOV EDI,DWORD PTR DS:[ESI+8]
  0107103F  |. 8B4E 14        MOV ECX,DWORD PTR DS:[ESI+14]
  01071042  |. 894D F4        MOV DWORD PTR SS:[EBP-C],ECX
  01071045  |. 8B57 04        MOV EDX,DWORD PTR DS:[EDI+4]
  01071048  |. 8955 EC        MOV DWORD PTR SS:[EBP-14],EDX
  0107104B  |. 8D5439 10      LEA EDX,DWORD PTR DS:[ECX+EDI+10]
  0107104F  |. 8955 FC        MOV DWORD PTR SS:[EBP-4],EDX
  01071052  |. 33D2           XOR EDX,EDX
  01071054  |. 3BDA           CMP EBX,EDX
  01071056  |. 8B5D 0C        MOV EBX,DWORD PTR SS:[EBP+C]
  01071059  |. 8955 F8        MOV DWORD PTR SS:[EBP-8],EDX
  0107105C  |. 75 2D          JNZ SHORT msreader.0107108B
  0107105E  |. 8B4D 08        MOV ECX,DWORD PTR SS:[EBP+8]
  01071061  |. 8345 FC 20     ADD DWORD PTR SS:[EBP-4],20
  01071065  |. 83E8 20        SUB EAX,20                        ; 0x00001fd0
  01071068  |. 3951 38        CMP DWORD PTR DS:[ECX+38],EDX
  0107106B  |. 8945 F0        MOV DWORD PTR SS:[EBP-10],EAX
  0107106E  |. 74 2E          JE SHORT msreader.0107109E
  01071070  |. FF73 0C        PUSH DWORD PTR DS:[EBX+C]
  01071073  |. 8D45 E4        LEA EAX,DWORD PTR SS:[EBP-1C]
  01071076  |. 50             PUSH EAX
  01071077  |. E8 E7450100    CALL msreader.01085663
  0107107C  |. 59             POP ECX
  0107107D  |. 59             POP ECX
  0107107E  |. 8D4D E4        LEA ECX,DWORD PTR SS:[EBP-1C]
  01071081  |. 2BC1           SUB EAX,ECX
  01071083  |. 8945 F8        MOV DWORD PTR SS:[EBP-8],EAX
  01071086  |. 8B45 F0        MOV EAX,DWORD PTR SS:[EBP-10]
  01071089  |. EB 13          JMP SHORT msreader.0107109E
  0107108B  |> 3955 18        CMP DWORD PTR SS:[EBP+18],EDX
  0107108E  |. 74 0E          JE SHORT msreader.0107109E
  01071090  |. 8B56 1C        MOV EDX,DWORD PTR DS:[ESI+1C]
  01071093  |. 0356 18        ADD EDX,DWORD PTR DS:[ESI+18]
  01071096  |. 03CA           ADD ECX,EDX
  01071098  |. 0155 FC        ADD DWORD PTR SS:[EBP-4],EDX
  0107109B  |. 894D F4        MOV DWORD PTR SS:[EBP-C],ECX
  0107109E  |> 8B4B 0C        MOV ECX,DWORD PTR DS:[EBX+C]
  010710A1  |. 034B 08        ADD ECX,DWORD PTR DS:[EBX+8]
  010710A4  |. 034D F8        ADD ECX,DWORD PTR SS:[EBP-8]
  010710A7  |. 3B4D EC        CMP ECX,DWORD PTR SS:[EBP-14]
  010710AA  |. 894D 0C        MOV DWORD PTR SS:[EBP+C],ECX
  010710AD  |. 0F87 61010000  JA msreader.01071214
  010710B3  |. 2B45 EC        SUB EAX,DWORD PTR SS:[EBP-14]     ; substract AOLL size
  010710B6  |. 2B45 F4        SUB EAX,DWORD PTR SS:[EBP-C]      ; substract the size at the end of the chunk
  010710B9 >|. 74 24          JE SHORT msreader.010710DF
  010710BB  |. 50             PUSH EAX
  010710BC  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
  010710BF  |. 03C8           ADD ECX,EAX
  010710C1  |. 50             PUSH EAX
  010710C2  |. 51             PUSH ECX
  010710C3  |. E8 103C0200    CALL <JMP.&MSVCRT.memmove>        ; memmove

So through the controlling of the 32bit value after the AOLL tag and/or
the 16bit one at the end of the chunk (offset 0x23ba of the provided
PoC) is possible to exploit the integer overflow for performing the
memmove of an arbitrary amount of data.

In the proof-of-concept I have set the amount of bytes to move to
0xffffffff for a quick and easy demonstration.

Modified bytes in the proof-of-concept:
000003DC   2B       6A  ; little endian 32bit value
000003DD   17       18
from offset 0xb6e till 0x23b0 I have replaced the original data with a
sequence of 'A's.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/msreader_3.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################