Vulnerabilities > CVE-2016-8713 - Out-of-bounds Write vulnerability in Gonitro Nitro PDF PRO 10.5.5.9
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10.5.9.9. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
Seebug
| bulletinFamily | exploit |
| description | ### Summary A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10.5.9.9. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability. Tested Versions Nitro Pro 10.5.9.9 (Nitro PDF Library - 10, 5, 9, 9) - x64 version ### Product URLs http://gonitro.com ### CVSSv3 Score 8.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H ### Details A memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. Vulnerable code is located in the npdf.dll library: ``` .text:0000000000268C20 loc_268C20: ; CODE XREF: sub_268BE0+A6j .text:0000000000268C20 movsxd rax, dword ptr [r9+800h] .text:0000000000268C27 mov rcx, rax .text:0000000000268C2A add rcx, rcx .text:0000000000268C2D movups xmm1, xmmword ptr [r9+rcx*8] .text:0000000000268C32 lea ecx, [r10-1] .text:0000000000268C36 add ecx, eax .text:0000000000268C38 cmp eax, ecx .text:0000000000268C3A jge short write_bug .text:0000000000268C3C mov r8, rax .text:0000000000268C3F shl r8, 4 .text:0000000000268C43 add r8, r9 .text:0000000000268C46 db 66h, 66h .text:0000000000268C46 nop word ptr [rax+rax+00000000h] .text:0000000000268C50 .text:0000000000268C50 loc_268C50: ; CODE XREF: sub_268BE0+8Ej .text:0000000000268C50 movups xmm0, xmmword ptr [r8+10h] .text:0000000000268C55 inc eax .text:0000000000268C57 lea r8, [r8+10h] .text:0000000000268C5B movups xmmword ptr [r8-10h], xmm0 .text:0000000000268C60 mov edx, [r9+800h] .text:0000000000268C67 dec edx .text:0000000000268C69 add edx, r10d .text:0000000000268C6C cmp eax, edx .text:0000000000268C6E jl short loc_268C50 .text:0000000000268C70 .text:0000000000268C70 write_bug: ; CODE XREF: sub_268BE0+5Aj .text:0000000000268C70 movsxd rax, dword ptr [r9+800h] .text:0000000000268C77 add rax, r10 .text:0000000000268C7A add rax, rax .text:0000000000268C7D movups xmmword ptr [r9+rax*8-10h], xmm1 ; * overwrite * .text:0000000000268C83 dec r11 .text:0000000000268C86 jnz short loc_268C20 ``` Memory access refered by selected instruction is presented below: ``` 0x268C20 ### mem read addr=0xd447740 rax=[mem]=78 0x268C2D ### mem read addr=0xd4476c0 xmm1=[mem]=2 0x268C50 ### mem read addr=0xd4476d0 xmm0=[mem]=2 0x268C5B ### mem write addr=d4476c0 [mem]=2 xmm0=2 0x268C50 ### mem read addr=0xd4476e0 xmm0=[mem]=2 0x268C5B ### mem write addr=d4476d0 [mem]=2 xmm0=2 0x268C50 ### mem read addr=0xd4476f0 xmm0=[mem]=2 0x268C5B ### mem write addr=d4476e0 [mem]=2 xmm0=2 0x268C50 ### mem read addr=0xd447700 xmm0=[mem]=2 0x268C5B ### mem write addr=d4476f0 [mem]=2 xmm0=2 0x268C50 ### mem read addr=0xd447710 xmm0=[mem]=2 0x268C5B ### mem write addr=d447700 [mem]=2 xmm0=2 0x268C50 ### mem read addr=0xd447720 xmm0=[mem]=2 0x268C5B ### mem write addr=d447710 [mem]=2 xmm0=2 0x268C50 ### mem read addr=0xd447730 xmm0=[mem]=2 0x268C5B ### mem write addr=d447720 [mem]=2 xmm0=2 0x268C50 ### mem read addr=0xd447740 xmm0=[mem]=78 0x268C5B ### mem write addr=d447730 [mem]=2 xmm0=78 0x268C50 ### mem read addr=0xd447750 xmm0=[mem]=abababab 0x268C5B ### mem write addr=d447740 [mem]=78 xmm0=abababab 0x268C70 ### mem read addr=0xd447740 rax=[mem]=abababab 0x268C7D ### mem write addr=c7ff2aa0 [mem]=Memory access error ``` Last memory access (instruction at 0x268C7D) is causing the exception to trigger. Instruction at 0x268C7D is using RAX register value to calculate the final memory address. RAX value is calculated by reading 32-bit memory from [r9+0x800] (with sign extension). Value at [r9+0x800] in this case is 0xABABABAB which is Microsoft's HeapAlloc() mark of "no man's land" guard bytes after allocated heap memory. In other words this memory should be never referenced in the first place. This value is later increased by r10 value (address 0x268C77) and multiplied by 2 (address 0x268C7A). ### Crash Information ``` 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** ERROR: Symbol file could not be found. Defaulted to export symbols for NitroPDF.exe - *** ERROR: Symbol file could not be found. Defaulted to export symbols for J:\nitro\Nitro_KissMetrics.dll - FAULTING_IP: npdf!CxImage###~CxImage+9474d 000007fe`da958c7d 410f114cc1f0 movups xmmword ptr [r9+rax*8-10h],xmm1 EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 000007feda958c7d (npdf!CxImage###~CxImage+0x000000000009474d) ExceptionCode: c000041d ExceptionFlags: 00000001 NumberParameters: 0 CONTEXT: 0000000000000000 -- (.cxr 0x0;r) rax=ffffffff5757576e rbx=00000000010eaf80 rcx=0000000000000083 rdx=00000000abababb6 rsi=0000000077b31148 rdi=00000000010eb470 rip=000007feda958c7d rsp=00000000010eb690 rbp=000000000d9dff90 r8=000000000db9b200 r9=000000000db9a9f0 r10=000000000000000c r11=0000000000000003 r12=000000000d9c6d50 r13=000000000d9dfcb8 r14=00000000010ebf38 r15=000000000d94f8b0 iopl=0 nv up ei ng nz na pe cy cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010281 npdf!CxImage###~CxImage+0x9474d: 000007fe`da958c7d 410f114cc1f0 movups xmmword ptr [r9+rax*8-10h],xmm1 ds:fffffffa`c8746550=???????????????????????????????? FAULTING_THREAD: 0000000000009ff4 DEFAULT_BUCKET_ID: APPLICATION_FAULT PROCESS_NAME: NitroPDF.exe ERROR_CODE: (NTSTATUS) 0xc000041d - Wyst EXCEPTION_CODE: (NTSTATUS) 0xc000041d - Wyst DETOURED_IMAGE: 1 NTGLOBALFLAG: 470 APPLICATION_VERIFIER_FLAGS: 0 APP: nitropdf.exe ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT BUGCHECK_STR: APPLICATION_FAULT_APPLICATION_FAULT LAST_CONTROL_TRANSFER: from 000007feda95754c to 000007feda958c7d STACK_TEXT: 00000000`010eb690 000007fe`da95754c : 00000000`00003153 00000000`00000000 00000000`010f0200 00000000`010f3153 : npdf!CxImage###~CxImage+0x9474d 00000000`010eb6a0 000007fe`da958ef5 : 00000000`0d9dff90 00000000`010ebd20 00000000`010ebc30 00000000`0d9c6d50 : npdf!CxImage###~CxImage+0x9301c 00000000`010eb6f0 000007fe`da8a4729 : 00000000`0db80aa0 00000000`010ebd20 00000000`010ebc30 00000000`0d9dfcb8 : npdf!CxImage###~CxImage+0x949c5 00000000`010eb720 000007fe`da8452b9 : 00000000`010ebd20 00000000`0d9dfcb8 00000000`010ebc30 00000000`77a3ab58 : npdf!TerminateApp+0xedfc9 00000000`010eb750 000007fe`da8ceb01 : 00000000`010f0000 00000000`009c009a 00000000`0d9dfcb8 00000000`010ebc60 : npdf!TerminateApp+0x8eb59 00000000`010ebbd0 000007fe`da923daf : 00000000`00000060 00000000`0d9d7e08 00000000`00000001 00000000`010f0000 : npdf!CxImage###~CxImage+0xa5d1 00000000`010ebc20 000007fe`da93529b : 00000000`00000002 00000000`0d9d7e08 00000000`00000000 00000000`00000002 : npdf!CxImage###~CxImage+0x5f87f 00000000`010ebeb0 000007fe`da8da4a8 : 00000000`00000002 00000000`00000000 00080000`00100081 000007fe`da700000 : npdf!CxImage###~CxImage+0x70d6b 00000000`010ec580 000007fe`da8dc0dc : 00000000`00000002 00000000`010ec700 00000000`00000002 00000000`0d9d7cd0 : npdf!CxImage###~CxImage+0x15f78 00000000`010ec600 000007fe`da8d2dc8 : 00000000`010f0000 00000000`0d9d7cd0 00000000`00000000 00000000`00000000 : npdf!CxImage###~CxImage+0x17bac 00000000`010ec7e0 000007fe`da8f68e0 : 00000000`0d9dfc80 00000000`010ee900 00000000`00000000 00000000`00000000 : npdf!CxImage###~CxImage+0xe898 00000000`010ecc60 000007fe`da8db70e : 00000000`0d9c6d50 00000000`0d9c6d50 00000000`0d9d7cd0 00000000`0d9dd660 : npdf!CxImage###~CxImage+0x323b0 00000000`010ed170 000007fe`da823752 : 00000000`0d9d7cd0 00000000`047e8040 0409001f`00000000 00000000`0d950780 : npdf!CxImage###~CxImage+0x171de 00000000`010ed6a0 000007fe`da824d45 : 00000000`0d950590 000007fe`fedf6a47 00000000`00000000 000007fe`fedf6941 : npdf!TerminateApp+0x6cff2 00000000`010edc30 00000001`3fc29bbc : 00000000`00000000 00000000`0d950590 00000000`010ee9e0 00000000`0d950590 : npdf!TerminateApp+0x6e5e5 00000000`010edc80 00000001`3fc2ec72 : 00000000`0d949e90 00000000`00000404 00000000`0d94a408 00000000`010ee9e0 : NitroPDF!CxMemFile###Scanf+0x6dbbc 00000000`010ee370 000007fe`e1104b26 : 00000000`010ee850 00000000`010ee888 00000000`0d949e90 000007fe`fedf1169 : NitroPDF!CxMemFile###Scanf+0x72c72 00000000`010ee820 000007fe`e1119079 : 00000000`0000020d 00000000`010ee9e0 00000000`00000000 00000000`00000001 : mfc120u!CView###OnPaint+0x5a 00000000`010ee8e0 000007fe`e1118a68 : 00000000`0d949e90 00000000`00000000 00000000`00000000 00000000`00000001 : mfc120u!CWnd###OnWndMsg+0x5dd 00000000`010eea60 000007fe`e1116422 : 00000000`00000000 00000000`01147a20 00000000`00000000 00000000`0d949e90 : mfc120u!CWnd###WindowProc+0x38 00000000`010eeaa0 000007fe`e11167a4 : 00000000`0000000f 00000000`01f610d8 00000000`010eebb8 000007fe`e1130538 : mfc120u!AfxCallWndProc+0x10e 00000000`010eeb50 000007fe`e0fd0a75 : 00000000`00000000 00000000`01f610d8 00000000`0000000f 000007fe`e1118a68 : mfc120u!AfxWndProc+0x54 00000000`010eeb90 00000000`777e9bd1 : 00000000`00000000 00000001`3fb10000 00000000`00000000 00000000`01147a20 : mfc120u!AfxWndProcBase+0x51 00000000`010eebe0 00000000`777e72cb : 00000000`00000000 000007fe`e0fd0a24 00000000`00000000 00000000`00000000 : USER32!UserCallWinProcCheckWow+0x1ad 00000000`010eeca0 00000000`777e6829 : 000007fe`e127c2f8 000007fe`e0fe9662 00000000`01150760 00000000`01147a78 : USER32!DispatchClientMessage+0xc3 00000000`010eed00 00000000`77a3dae5 : 00000000`00341dde 00000000`777e89fc 00016cec`0000001a 000007fe`e10c5731 : USER32!_fnDWORD+0x2d 00000000`010eed60 00000000`777e6e5a : 00000000`777e6e6c 00000000`00000000 00000000`01147a20 00000000`01147a78 : ntdll!KiUserCallbackDispatcherContinue 00000000`010eede8 00000000`777e6e6c : 00000000`00000000 00000000`01147a20 00000000`01147a78 000007fe`e11010e8 : USER32!NtUserDispatchMessage+0xa 00000000`010eedf0 000007fe`e1100fb6 : 00000000`01147a78 00000000`01147a78 000007fe`e0fd0a24 00000000`00000000 : USER32!DispatchMessageWorker+0x55b 00000000`010eee70 000007fe`e110180e : 00000001`3ff87800 00000001`3fb10000 00000000`00000000 00000000`00000000 : mfc120u!AfxInternalPumpMessage+0x52 00000000`010eeea0 00000001`3fc6d1b1 : 00000001`3ff87800 00000001`3fb10000 00000000`00000000 00000000`0337df50 : mfc120u!CWinThread###Run+0x6e 00000000`010eeee0 000007fe`e11300de : 00000000`0000000a 00000000`0000000a 00000000`00000000 00000000`010f3cda : NitroPDF!CxMemFile###Scanf+0xb11b1 00000000`010ef9e0 00000001`3fda21a6 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`0000001f : mfc120u!AfxWinMain+0xa6 00000000`010efa20 00000000`778e59cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NitroPDF!CxImageJPG###CxExifInfo###process_SOFn+0x71d96 00000000`010efa60 00000000`77a1b891 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd 00000000`010efa90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d STACK_COMMAND: .cxr 0x0 ; kb FOLLOWUP_IP: npdf!CxImage###~CxImage+9474d 000007fe`da958c7d 410f114cc1f0 movups xmmword ptr [r9+rax*8-10h],xmm1 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: npdf!CxImage###~CxImage+9474d FOLLOWUP_NAME: MachineOwner MODULE_NAME: npdf IMAGE_NAME: npdf.dll DEBUG_FLR_IMAGE_TIMESTAMP: 5791f671 FAILURE_BUCKET_ID: APPLICATION_FAULT_c000041d_npdf.dll!CxImage###_CxImage BUCKET_ID: X64_APPLICATION_FAULT_APPLICATION_FAULT_DETOURED_npdf!CxImage###_CxImage+9474d ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:application_fault_c000041d_npdf.dll!cximage###_cximage FAILURE_ID_HASH: {2a602c9f-d2b3-eec9-a6ce-9d36a15b74b7} Followup: MachineOwner --------- ``` ### Timeline * 2016-10-26 - Initial Discovery * 2016-11-04 - Vendor Notification * 2017-02-03 - Public Disclosure ### CREDIT * Discovered by Piotr Bania of Cisco Talos. |
| id | SSV:96581 |
| last seen | 2017-11-19 |
| modified | 2017-09-26 |
| published | 2017-09-26 |
| reporter | Root |
| title | Nitro Pro 10 PDF Handling Code Execution Vulnerability(CVE-2016-8713) |
Talos
| id | TALOS-2016-0226 |
| last seen | 2019-05-29 |
| published | 2017-02-03 |
| reporter | Talos Intelligence |
| source | http://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0226 |
| title | Nitro Pro 10 PDF Handling Code Execution Vulnerability |