exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Sketchup MAC Pict Material Palette Stack Corruption

Sketchup MAC Pict Material Palette Stack Corruption
Posted May 31, 2013
Authored by Felipe Andres Manzano

SketchUp is a 3D modeling program marketed by Google (2011) and designed for architectural, civil, and mechanical engineers as well as filmmakers, game developers, and related professions. SketchUp fails to validate the input when parsing an embedded MACPict texture. Arbitrary code execution is proved possible after a malicious texture or thumbnail or background image triggers a stack overflow. The issue can also be triggered when Windows Explorer reads the embedded thumbnail in a .skp file.

tags | advisory, overflow, arbitrary, code execution
systems | windows
advisories | CVE-2013-3662
SHA-256 | 5d7db50f9ade70ce95f84ac3b672882ffe82ae29e7be793a09e28762eee3b890

Sketchup MAC Pict Material Palette Stack Corruption

Change Mirror Download
If you are still using an old version of SketchUp(8M2) you should upgrade it.

Title: Sketchup MAC Pict Material Palette Stack Corruption
Product: Google SketchUp
Advisory ID: BINA-20111201
CVE ID: CVE-2013-3662
Class: Boundary Error Condition (Buffer Overflow)
Vulnerability class: Client side/ file format
Permalink: http://binamuse.com/advisories/BINA-20111201.txt
Vendor notified on: 2011-07-18
Patch/Fix Released: 2011-12-01
Advisory Published: 2013-05-23

Vulnerability Description:

SketchUp is a 3D modeling program marketed by Google (2011) and designed
for architectural, civil, and mechanical engineers as well as filmmakers,
game developers, and related professions.

SketchUp fails to validate the input when parsing an embedded MACPict
texture. Arbitrary code execution is proved possible after a malicious
texture or thumbnail or background image triggers a stack overflow.
The issue can also be triggered when Windows Explorer reads the embedded
thumbnail in a .skp file.

Vulnerable Packages:

SketchUp 8 - Maintenance 1
SketchUp 8
SketchUp 7.1 - Maintenance 2
SketchUp 7.1 - Maintenance 1
SketchUp 7.1
SketchUp 7 - Maintenance 1
SketchUp Pro 6 - Maintenance 6

Not Vulnerable Packages:

SketchUp 8 - Maintenance 2 and abobe

Solution/Vendor Information/Workaround:
Upgrade to Sketchup 2013
URL: http://www.sketchup.com/products/sketchup-pro/new-in-2013

Or to get the latest version of SketchUp 8:
Windows: Choose Help > Check for Update
Mac: Choose SketchUp > Check Web for Update

Credits:

This vulnerability was found by Felipe Andres Manzano of the
Binamuse Vulnerability Research Team, http://binamuse.com

Technical Description:

Sketchup fails to validate the input when parsing an embedded MAC Pict
texture, leading to an arbitrary stack offset overwrite and finally to an
arbitrary code execution.

The native SketchUp fileformat can handle textured 3D content. Sketchup
can create realistic materials taken from image files such as jpg pictures
taken with a digital camera. A number of this images can be embedded into
the main .skp file and loaded every time the 3D scene is open.

The bug is triggered when SketchUp loads the color palette table of a
MAC Pict material (or embedded image).

'' In the Windows version 8.0.4811 the function responsible
for the pallete loading can be found at address 0x8849B0 ''

A MAC Pict file can hold palettes of up to 64k colors. It is encoded so the
number of colors to read from the file is the first 16bit unsigned value of the
encoded palette.

'>H' numColors

Then it follows a list of up to numColors palette entries.

[
'>H' color index
'BBB' RGB
] * numColors

Each entry is a pair of index and RGB color and the entries can be put in any
order. The only constraint is that each index must be less or equal
than numColor.
SketchUp reads this potentially 64k entries length table in a 256
entries length
stack buffer.

Thus, is fair to say that an almost arbitrary offset of the stack can
be written
with an almost arbitrary value. Playing with the stacked local values of the
calling functions it is possible to capture the execution flow and execute
arbitrary code.

REFERENCES:

http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html

DISCLAIMER:

The content of this advisory are copyright (c) 2013 Binamuse Inc.
and may be distributed freely provided that no fee is charged for this
distribution and proper credit is given.

f/


Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close