#######################################################################

                             Luigi Auriemma

Application:  Microsoft Reader
              http://www.microsoft.com/reader
Versions:     <= 2.1.1.3143 (PC version)
              the Origami 2.6.1.7169 version doesn't seem vulnerable
              the non-PC versions have not been tested
Platforms:    Windows, Windows Mobile, Tablet PC and UMPC devices
Bug:          writing of NULL byte in arbitrary location
Date:         11 Apr 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Microsoft Reader is a software needed to read and catalog the ebooks in
LIT format and the Audible audio books bought via internet, indeed the
homepage acts also as online store for these protected contents.


#######################################################################

======
2) Bug
======


Possibility to write a 0x00 byte in an arbitrary memory location.
From aud_file.dll (base address 5fff0000):

  5FFF634A >|> 8D47 01        |LEA EAX,DWORD PTR DS:[EDI+1]             ; size at offset 0xbd of the PoC
  5FFF634D  |. 50             |PUSH EAX
  5FFF634E  |. E8 2B470000    |CALL <JMP.&MSVCRT.??2@YAPAXI@Z>          ; malloc
  5FFF6353  |. 57             |PUSH EDI
  5FFF6354  |. 50             |PUSH EAX
  5FFF6355  |. FF75 08        |PUSH DWORD PTR SS:[EBP+8]
  5FFF6358  |. 8945 F8        |MOV DWORD PTR SS:[EBP-8],EAX
  5FFF635B  |. E8 58460000    |CALL <JMP.&utils.?read_bytes@TypeIO@@SA> ; read
  5FFF6360  |. 8B45 F8        |MOV EAX,DWORD PTR SS:[EBP-8]
  5FFF6363  |. 83C4 10        |ADD ESP,10
  5FFF6366  |. 802438 00      |AND BYTE PTR DS:[EAX+EDI],0              ; place the delimiter (all ok)
  5FFF636A  |. 807D FF 00     |CMP BYTE PTR SS:[EBP-1],0
  5FFF636E  |. 75 5B          |JNZ SHORT aud_file.5FFF63CB
  5FFF6370  |. 8D46 01        |LEA EAX,DWORD PTR DS:[ESI+1]             ; size at offset 0xc1 of the PoC
  5FFF6373  |. 50             |PUSH EAX
  5FFF6374  |. E8 05470000    |CALL <JMP.&MSVCRT.??2@YAPAXI@Z>          ; now malloc will return NULL
  5FFF6379  |. 8BD8           |MOV EBX,EAX
  5FFF637B  |. 56             |PUSH ESI
  5FFF637C  |. 53             |PUSH EBX
  5FFF637D  |. FF75 08        |PUSH DWORD PTR SS:[EBP+8]
  5FFF6380  |. E8 33460000    |CALL <JMP.&utils.?read_bytes@TypeIO@@SA> ; read
  5FFF6385  |. 802433 00      |AND BYTE PTR DS:[EBX+ESI],0              ; exploitation

The first allocation must succeed to avoid problems during the
reading operations (like memcpy on 0x00000000).

Note that is not possible to exploit the visible integer overflow
caused by malloc(size + 1) because the function that reads the data
goes in endless loop, yeah bad.

The provided proof-of-concept first tries to allocate 0x44000000 bytes
and it should succeed without problems and then will try to allocate
the second size that MUST fail so that is possible to use the size
value as an arbitrary memory offset.

Modified bytes in the proof-of-concept:
000000BD   00       43  ; first size needed to steal memory to the next size
000000BE   00       FF
000000BF   00       FF
000000C0   0A       FF
000000C1   00       61  ; second size, will try to write 0x00 at address 0x61616161
000000C2   00       61
000000C3   00       61
000000C4   16       61


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/msreader_5.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################