MS05-025 PNG Image Rendering Vulnerability
Pedram Amini (pedram) <pedramaminigmailcom> Tuesday, June 21 2005 19:49.27 CDT


Spent some time with spoonm over the weekend at RECON tinkering with the MS05-025 PNG vulnerability. Using my own not-as-cool-as-halvar's bindiff tool I came across the following significant change:



The left column is pre-patch and the right column is post-patch. Further tracing reveals the actual vulnerable loop that leads to heap corruption, a jump table for which case 0x9 is required to reach the vulnerable function and some other interesting tidbits. All in all the vulnerability wasn't difficult to pin point, the biggest hurdle is overcoming the lazyness required to generate a valid PNG image as the CRC checks seem to be done prior to reaching the vulnerable code.

Comments
Posted: Wednesday, December 31 1969 18:00.00 CST