Apple CoreGraphics (Preview) Memory Corruption Vulnerability - CVE-2010-1801

[Rodrigo Branco <rbranco () checkpoint com>]

Dear List,


I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability.


Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Apple CoreGraphics (Preview) Memory Corruption when parsing PDF files
CVE-2010-1801


INTRODUCTION

Apple Preview.app is the default application used in Apple MacOS systems in order to visualize PDF files and does not 
properly parse PDF files, which leads to memory corruption when opening a malformed file with an invalid size on JBIG2 
structure at offset 0x2C1 as in PoC Repro1.pdf or offset 0x2C5 as in PoC Repro2.pdf (both values trigger the same 
vulnerability).

This problem was confirmed in the following versions of Apple Preview and MacOS, other versions may be also affected.

Apple Mac OS X 10.5.8 (Server as well)
Apple Mac OS X 10.6.2 (Server as well)
Apple Mac OS X 10.6.3 (Server as well)
Apple Mac OS X 10.6.4 (Server as well)

CVSS Scoring System

The CVSS score is: 9
        Base Score: 10
        Temporal Score: 9
We used the following values to calculate the scores:
        Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
        Temporal score is: E:POC/RL:U/RC:C


TRIGGERING THE PROBLEM

This vulnerability can be triggered by creating an invalid JBIG2 structure in two different ways.

The problem is triggered by PoCs available to interested parts which causes invalid memory access in all the refered 
versions.


DETAILS


Changing offset 0x2C1:

0xdee8600 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3764>:     xor    %esi,%esi 
0xdee8602 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3766>:     mov    -0x7c(%ebp),%edx
0xdee8605 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3769>:     mov    -0x118(%ebp),%eax
0xdee860b <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3775>:     mov    -0x7c(%ebp),%ecx
0xdee860e <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3778>:     inc    %edx 
0xdee860f <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3779>:     cmp    0x8(%eax),%ecx
0xdee8612 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3782>:     jae    0xdee861a 
<_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3790>
0xdee8614 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3784>:     mov    0xc(%eax),%eax
0xdee8617 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+3787>:     mov    %esi,(%eax,%edi,1) <----- Crash

(gdb) i r $esi $eax $edi
esi            0xc79e860        209315936
eax            0x0      0
edi            0x0      0

(gdb) bt
#0  0x0dee8617 in JBIG2Stream::readSymbolDictSeg ()
#1  0x0dee4f0f in JBIG2Stream::readSegments ()
#2  0x0dee4b5e in JBIG2Stream::reset ()
#3  0x0dee499b in read_bytes ()
#4  0x96d33f32 in jbig2_filter_refill ()
#5  0x96a4b56c in CGPDFSourceRefill ()
#6  0x96a4b402 in CGPDFSourceRead ()


Changing offset 0x2C5:

0xdeb52dc <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2960>:     inc    %esp
0xdeb52dd <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2961>:     and    $0x4,%al
0xdeb52df <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2963>:     add    %al,(%eax)
0xdeb52e1 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2965>:     add    %al,(%eax)
0xdeb52e3 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2967>:     mov    %edx,(%esp)
0xdeb52e6 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2970>:     call   0xdeb2a96 
<_ZN11JBIG2Stream17readGenericBitmapEiiiiiiP11JBIG2BitmapPiS2_i>
0xdeb52eb <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2975>:     mov    -0x94(%ebp),%ecx
0xdeb52f1 <_ZN11JBIG2Stream17readSymbolDictSegEjjPjj+2981>:     mov    %eax,(%ecx) <----- Crash


(gdb) i r $eax $ecx
eax            0xc79b640        209303104
ecx            0x0      0



(gdb) bt
#0  0x0deb52f1 in JBIG2Stream::readSymbolDictSeg ()
#1  0x0deb1f0f in JBIG2Stream::readSegments ()
#2  0x0deb1b5e in JBIG2Stream::reset ()
#3  0x0deb199b in read_bytes ()
#4  0x96d33f32 in jbig2_filter_refill ()
#5  0x96a4b56c in CGPDFSourceRefill ()
#6  0x96a4b402 in CGPDFSourceRead ()
#7  0x96aa3c8f in CGAccessSessionGetChunks ()



CREDITS

This vulnerability was discovered and researched by Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team 
(VDT).





Best Regards,
 
Rodrigo.
 
--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies