CVE-2016-8713
A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10.5.9.9. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.
8.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption.
Vulnerable code is located in the npdf.dll library:
.text:0000000000268C20 loc_268C20: ; CODE XREF: sub_268BE0+A6j
.text:0000000000268C20 movsxd rax, dword ptr [r9+800h]
.text:0000000000268C27 mov rcx, rax
.text:0000000000268C2A add rcx, rcx
.text:0000000000268C2D movups xmm1, xmmword ptr [r9+rcx*8]
.text:0000000000268C32 lea ecx, [r10-1]
.text:0000000000268C36 add ecx, eax
.text:0000000000268C38 cmp eax, ecx
.text:0000000000268C3A jge short write_bug
.text:0000000000268C3C mov r8, rax
.text:0000000000268C3F shl r8, 4
.text:0000000000268C43 add r8, r9
.text:0000000000268C46 db 66h, 66h
.text:0000000000268C46 nop word ptr [rax+rax+00000000h]
.text:0000000000268C50
.text:0000000000268C50 loc_268C50: ; CODE XREF: sub_268BE0+8Ej
.text:0000000000268C50 movups xmm0, xmmword ptr [r8+10h]
.text:0000000000268C55 inc eax
.text:0000000000268C57 lea r8, [r8+10h]
.text:0000000000268C5B movups xmmword ptr [r8-10h], xmm0
.text:0000000000268C60 mov edx, [r9+800h]
.text:0000000000268C67 dec edx
.text:0000000000268C69 add edx, r10d
.text:0000000000268C6C cmp eax, edx
.text:0000000000268C6E jl short loc_268C50
.text:0000000000268C70
.text:0000000000268C70 write_bug: ; CODE XREF: sub_268BE0+5Aj
.text:0000000000268C70 movsxd rax, dword ptr [r9+800h]
.text:0000000000268C77 add rax, r10
.text:0000000000268C7A add rax, rax
.text:0000000000268C7D movups xmmword ptr [r9+rax*8-10h], xmm1 ; * overwrite *
.text:0000000000268C83 dec r11
.text:0000000000268C86 jnz short loc_268C20
Memory access refered by selected instruction is presented below:
0x268C20 ### mem read addr=0xd447740 rax=[mem]=78
0x268C2D ### mem read addr=0xd4476c0 xmm1=[mem]=2
0x268C50 ### mem read addr=0xd4476d0 xmm0=[mem]=2
0x268C5B ### mem write addr=d4476c0 [mem]=2 xmm0=2
0x268C50 ### mem read addr=0xd4476e0 xmm0=[mem]=2
0x268C5B ### mem write addr=d4476d0 [mem]=2 xmm0=2
0x268C50 ### mem read addr=0xd4476f0 xmm0=[mem]=2
0x268C5B ### mem write addr=d4476e0 [mem]=2 xmm0=2
0x268C50 ### mem read addr=0xd447700 xmm0=[mem]=2
0x268C5B ### mem write addr=d4476f0 [mem]=2 xmm0=2
0x268C50 ### mem read addr=0xd447710 xmm0=[mem]=2
0x268C5B ### mem write addr=d447700 [mem]=2 xmm0=2
0x268C50 ### mem read addr=0xd447720 xmm0=[mem]=2
0x268C5B ### mem write addr=d447710 [mem]=2 xmm0=2
0x268C50 ### mem read addr=0xd447730 xmm0=[mem]=2
0x268C5B ### mem write addr=d447720 [mem]=2 xmm0=2
0x268C50 ### mem read addr=0xd447740 xmm0=[mem]=78
0x268C5B ### mem write addr=d447730 [mem]=2 xmm0=78
0x268C50 ### mem read addr=0xd447750 xmm0=[mem]=abababab
0x268C5B ### mem write addr=d447740 [mem]=78 xmm0=abababab
0x268C70 ### mem read addr=0xd447740 rax=[mem]=abababab
0x268C7D ### mem write addr=c7ff2aa0 [mem]=Memory access error
Last memory access (instruction at 0x268C7D) is causing the exception to trigger. Instruction at 0x268C7D is using RAX register value to calculate the final memory address. RAX value is calculated by reading 32-bit memory from [r9+0x800] (with sign extension). Value at [r9+0x800] in this case is 0xABABABAB which is Microsoft’s HeapAlloc() mark of “no man’s land” guard bytes after allocated heap memory. In other words this memory should be never referenced in the first place. This value is later increased by r10 value (address 0x268C77) and multiplied by 2 (address 0x268C7A).
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for NitroPDF.exe -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for J:\nitro\Nitro_KissMetrics.dll -
FAULTING_IP:
npdf!CxImage###~CxImage+9474d
000007fe`da958c7d 410f114cc1f0 movups xmmword ptr [r9+rax*8-10h],xmm1
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007feda958c7d (npdf!CxImage###~CxImage+0x000000000009474d)
ExceptionCode: c000041d
ExceptionFlags: 00000001
NumberParameters: 0
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=ffffffff5757576e rbx=00000000010eaf80 rcx=0000000000000083
rdx=00000000abababb6 rsi=0000000077b31148 rdi=00000000010eb470
rip=000007feda958c7d rsp=00000000010eb690 rbp=000000000d9dff90
r8=000000000db9b200 r9=000000000db9a9f0 r10=000000000000000c
r11=0000000000000003 r12=000000000d9c6d50 r13=000000000d9dfcb8
r14=00000000010ebf38 r15=000000000d94f8b0
iopl=0 nv up ei ng nz na pe cy
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010281
npdf!CxImage###~CxImage+0x9474d:
000007fe`da958c7d 410f114cc1f0 movups xmmword ptr [r9+rax*8-10h],xmm1 ds:fffffffa`c8746550=????????????????????????????????
FAULTING_THREAD: 0000000000009ff4
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: NitroPDF.exe
ERROR_CODE: (NTSTATUS) 0xc000041d - Wyst
EXCEPTION_CODE: (NTSTATUS) 0xc000041d - Wyst
DETOURED_IMAGE: 1
NTGLOBALFLAG: 470
APPLICATION_VERIFIER_FLAGS: 0
APP: nitropdf.exe
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT
BUGCHECK_STR: APPLICATION_FAULT_APPLICATION_FAULT
LAST_CONTROL_TRANSFER: from 000007feda95754c to 000007feda958c7d
STACK_TEXT:
00000000`010eb690 000007fe`da95754c : 00000000`00003153 00000000`00000000 00000000`010f0200 00000000`010f3153 : npdf!CxImage###~CxImage+0x9474d
00000000`010eb6a0 000007fe`da958ef5 : 00000000`0d9dff90 00000000`010ebd20 00000000`010ebc30 00000000`0d9c6d50 : npdf!CxImage###~CxImage+0x9301c
00000000`010eb6f0 000007fe`da8a4729 : 00000000`0db80aa0 00000000`010ebd20 00000000`010ebc30 00000000`0d9dfcb8 : npdf!CxImage###~CxImage+0x949c5
00000000`010eb720 000007fe`da8452b9 : 00000000`010ebd20 00000000`0d9dfcb8 00000000`010ebc30 00000000`77a3ab58 : npdf!TerminateApp+0xedfc9
00000000`010eb750 000007fe`da8ceb01 : 00000000`010f0000 00000000`009c009a 00000000`0d9dfcb8 00000000`010ebc60 : npdf!TerminateApp+0x8eb59
00000000`010ebbd0 000007fe`da923daf : 00000000`00000060 00000000`0d9d7e08 00000000`00000001 00000000`010f0000 : npdf!CxImage###~CxImage+0xa5d1
00000000`010ebc20 000007fe`da93529b : 00000000`00000002 00000000`0d9d7e08 00000000`00000000 00000000`00000002 : npdf!CxImage###~CxImage+0x5f87f
00000000`010ebeb0 000007fe`da8da4a8 : 00000000`00000002 00000000`00000000 00080000`00100081 000007fe`da700000 : npdf!CxImage###~CxImage+0x70d6b
00000000`010ec580 000007fe`da8dc0dc : 00000000`00000002 00000000`010ec700 00000000`00000002 00000000`0d9d7cd0 : npdf!CxImage###~CxImage+0x15f78
00000000`010ec600 000007fe`da8d2dc8 : 00000000`010f0000 00000000`0d9d7cd0 00000000`00000000 00000000`00000000 : npdf!CxImage###~CxImage+0x17bac
00000000`010ec7e0 000007fe`da8f68e0 : 00000000`0d9dfc80 00000000`010ee900 00000000`00000000 00000000`00000000 : npdf!CxImage###~CxImage+0xe898
00000000`010ecc60 000007fe`da8db70e : 00000000`0d9c6d50 00000000`0d9c6d50 00000000`0d9d7cd0 00000000`0d9dd660 : npdf!CxImage###~CxImage+0x323b0
00000000`010ed170 000007fe`da823752 : 00000000`0d9d7cd0 00000000`047e8040 0409001f`00000000 00000000`0d950780 : npdf!CxImage###~CxImage+0x171de
00000000`010ed6a0 000007fe`da824d45 : 00000000`0d950590 000007fe`fedf6a47 00000000`00000000 000007fe`fedf6941 : npdf!TerminateApp+0x6cff2
00000000`010edc30 00000001`3fc29bbc : 00000000`00000000 00000000`0d950590 00000000`010ee9e0 00000000`0d950590 : npdf!TerminateApp+0x6e5e5
00000000`010edc80 00000001`3fc2ec72 : 00000000`0d949e90 00000000`00000404 00000000`0d94a408 00000000`010ee9e0 : NitroPDF!CxMemFile###Scanf+0x6dbbc
00000000`010ee370 000007fe`e1104b26 : 00000000`010ee850 00000000`010ee888 00000000`0d949e90 000007fe`fedf1169 : NitroPDF!CxMemFile###Scanf+0x72c72
00000000`010ee820 000007fe`e1119079 : 00000000`0000020d 00000000`010ee9e0 00000000`00000000 00000000`00000001 : mfc120u!CView###OnPaint+0x5a
00000000`010ee8e0 000007fe`e1118a68 : 00000000`0d949e90 00000000`00000000 00000000`00000000 00000000`00000001 : mfc120u!CWnd###OnWndMsg+0x5dd
00000000`010eea60 000007fe`e1116422 : 00000000`00000000 00000000`01147a20 00000000`00000000 00000000`0d949e90 : mfc120u!CWnd###WindowProc+0x38
00000000`010eeaa0 000007fe`e11167a4 : 00000000`0000000f 00000000`01f610d8 00000000`010eebb8 000007fe`e1130538 : mfc120u!AfxCallWndProc+0x10e
00000000`010eeb50 000007fe`e0fd0a75 : 00000000`00000000 00000000`01f610d8 00000000`0000000f 000007fe`e1118a68 : mfc120u!AfxWndProc+0x54
00000000`010eeb90 00000000`777e9bd1 : 00000000`00000000 00000001`3fb10000 00000000`00000000 00000000`01147a20 : mfc120u!AfxWndProcBase+0x51
00000000`010eebe0 00000000`777e72cb : 00000000`00000000 000007fe`e0fd0a24 00000000`00000000 00000000`00000000 : USER32!UserCallWinProcCheckWow+0x1ad
00000000`010eeca0 00000000`777e6829 : 000007fe`e127c2f8 000007fe`e0fe9662 00000000`01150760 00000000`01147a78 : USER32!DispatchClientMessage+0xc3
00000000`010eed00 00000000`77a3dae5 : 00000000`00341dde 00000000`777e89fc 00016cec`0000001a 000007fe`e10c5731 : USER32!_fnDWORD+0x2d
00000000`010eed60 00000000`777e6e5a : 00000000`777e6e6c 00000000`00000000 00000000`01147a20 00000000`01147a78 : ntdll!KiUserCallbackDispatcherContinue
00000000`010eede8 00000000`777e6e6c : 00000000`00000000 00000000`01147a20 00000000`01147a78 000007fe`e11010e8 : USER32!NtUserDispatchMessage+0xa
00000000`010eedf0 000007fe`e1100fb6 : 00000000`01147a78 00000000`01147a78 000007fe`e0fd0a24 00000000`00000000 : USER32!DispatchMessageWorker+0x55b
00000000`010eee70 000007fe`e110180e : 00000001`3ff87800 00000001`3fb10000 00000000`00000000 00000000`00000000 : mfc120u!AfxInternalPumpMessage+0x52
00000000`010eeea0 00000001`3fc6d1b1 : 00000001`3ff87800 00000001`3fb10000 00000000`00000000 00000000`0337df50 : mfc120u!CWinThread###Run+0x6e
00000000`010eeee0 000007fe`e11300de : 00000000`0000000a 00000000`0000000a 00000000`00000000 00000000`010f3cda : NitroPDF!CxMemFile###Scanf+0xb11b1
00000000`010ef9e0 00000001`3fda21a6 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`0000001f : mfc120u!AfxWinMain+0xa6
00000000`010efa20 00000000`778e59cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NitroPDF!CxImageJPG###CxExifInfo###process_SOFn+0x71d96
00000000`010efa60 00000000`77a1b891 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`010efa90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
STACK_COMMAND: .cxr 0x0 ; kb
FOLLOWUP_IP:
npdf!CxImage###~CxImage+9474d
000007fe`da958c7d 410f114cc1f0 movups xmmword ptr [r9+rax*8-10h],xmm1
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: npdf!CxImage###~CxImage+9474d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: npdf
IMAGE_NAME: npdf.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5791f671
FAILURE_BUCKET_ID: APPLICATION_FAULT_c000041d_npdf.dll!CxImage###_CxImage
BUCKET_ID: X64_APPLICATION_FAULT_APPLICATION_FAULT_DETOURED_npdf!CxImage###_CxImage+9474d
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:application_fault_c000041d_npdf.dll!cximage###_cximage
FAILURE_ID_HASH: {2a602c9f-d2b3-eec9-a6ce-9d36a15b74b7}
Followup: MachineOwner
---------
2016-10-26 - Initial Discovery
2016-11-04 - Vendor Notification
2017-02-03 - Public Disclosure
Discovered by Piotr Bania of Cisco Talos.