Title:
======
Google SketchUp v8.x - Memory Corruption Vulnerability


Date:
=====
2011-09-13



VL-ID:
=====
99


Introduction:
=============
Google SketchUp Pro is 3D modeling software for professionals. SketchUp is easy and intuitive, allowing anyone to model 
in 3D quickly and accurately. Using 3D models, designers can make more informed decisions, communicate project details, 
and share ideas with colleagues and customers to reach a common goal. SketchUp Pro includes LayOut, a 2D documentation 
and presentation tool for professionals. LayOut combines 3D models with text and 2D drawing elements to create design 
documents, construction drawings and compelling digital presentations.

(Copy of the Vendor Homepage: http://sketchup.google.com/intl/de/download/)


Abstract:
=========
Vulnerability-Lab Team discovered a Memory Corruption Vulnerability on Googles SketchUp Software v7.x.


Report-Timeline:
================
2011-09-13:  Public or Non-Public Disclosure


Status:
========
Published


Affected Products:
==================

Exploitation-Technique:
=======================
Local


Severity:
=========
Medium


Details:
========
A Memory Corruption vulnerability is detected on the Google s SketchUp v8.x. The vulnerability is caused by an memory corruption when 
processing corrupt DAE files through the filter, which could be exploited by attackers to crash an affected/vulnerable application. 
Its also possible to execute maschine specific code by tricking a user into opening a special crafted (manipulated) DAE file. The bug 
is located in the configuration & transformation handling of .dae import function (module).

Vulnerable Module(s): 
                          [+] DAE - Import


--- Bugsplat Logs ---
2011-07-24 20:20:55  Entered Unhandled Exception Filter
2011-07-24 20:20:55  Minidump file successfully saved    C:/Users/Rem0ve/AppData/Local/Temp/SketchUp4EKL42V3.dmp
2011-07-24 20:20:55  Launching BsSndRpt.exe              /BsSndRpt.exe/ /i /C:/Users/Rem0ve/AppData/Local/Temp/BsSndRpt.ini/ 
2011-07-24 20:26:00  Entered Unhandled Exception Filter
2011-07-24 20:26:01  Minidump file successfully saved    C:/Users/Rem0ve/AppData/Local/Temp/SketchUpUHV15AH1.dmp
2011-07-24 20:26:01  Launching BsSndRpt.exe              /BsSndRpt.exe/ /i /C:/Users/Rem0ve/AppData/Local/Temp/BsSndRpt.ini/ 
2011-07-24 20:26:53  Entered Unhandled Exception Filter
2011-07-24 20:26:54  Minidump file successfully saved    C:/Users/Rem0ve/AppData/Local/Temp/SketchUpGRD510S5.dmp
2011-07-24 20:26:54  Launching BsSndRpt.exe              /BsSndRpt.exe/ /i /C:/Users/Rem0ve/AppData/Local/Temp/BsSndRpt.ini/ 
2011-07-24 20:35:51  Entered Unhandled Exception Filter
2011-07-24 20:35:51  Minidump file successfully saved    C:/Users/Rem0ve/AppData/Local/Temp/SketchUp4H214T15.dmp
2011-07-24 20:35:51  Launching BsSndRpt.exe              /BsSndRpt.exe/ /i /C:/Users/Rem0ve/AppData/Local/Temp/BsSndRpt.ini/ 


--- Sketchup Logs ---
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)
Commit(0)

--- Exception Logs ---
(10f4.dcc): C++ EH exception - code e06d7363 (first chance)
eax=0986ef50 ebx=08b05001 ecx=00000003 edx=00000000 esi=08cbf53c edi=090433d8
eip=75feb727 esp=0986ef50 ebp=0986efa0 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000216
KERNELBASE!RaiseException+0x58:
75feb727 c9              
0:001> gn
(10f4.dcc): C++ EH exception - code e06d7363 (first chance)
eax=0986edfc ebx=08afce20 ecx=00000003 edx=00000000 esi=0986f4c0 edi=08f4b4b0
eip=75feb727 esp=0986edfc ebp=0986ee4c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
KERNELBASE!RaiseException+0x58:
75feb727 c9              
0:001> gn
(10f4.dcc): C++ EH exception - code e06d7363 (first chance)
eax=0986edfc ebx=08afce20 ecx=00000003 edx=00000000 esi=0986f4c0 edi=08f90bd0
eip=75feb727 esp=0986edfc ebp=0986ee4c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
KERNELBASE!RaiseException+0x58:
75feb727 c9              
0:001> g
eax=00000000 ebx=77a21c04 ecx=00000000 edx=00000000 esi=004da500 edi=00000000
eip=779e00ed esp=0672fc8c ebp=0672fe20 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!NtWaitForMultipleObjects+0x15:
779e00ed 83c404          add     esp,4


Information:
The sketchup exception-handling filters wrong or manipulated file imports & mark them as not working(wrong.png).
The PoC is not affected by the sketchup exception-handling & get through without any blocking exception-handling. 


Pictures:
      ../1.png
      ../2.png
      ../2.2-bex.png
      ../3.png
      ../wrong.png

Analyses:
      ../AppCrash_SketchUp.exe_b7af0d96025b256cb43f14bb2184042bfdb54f4_114ea662
      ../AppCrash_SketchUp.exe_b23e85cdd9cd939dfa22fccaf81865a57c03cb_12666c3f
      ../Crash Reports
      ../SketchUp5FMH3QI7.dmp
      ../SketchUpCTOP41M5.dmp
      ../bugsplat.log


Risk:
=====
The security risk of the memory corruption vulnerability is estimated as medium.


Credits:
========
Vulnerability Research Laboratory - Benjamin Kunz Mejri (Rem0ve)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of 
other media, are reserved by Vulnerability-Lab or its suppliers.