SketchUp memory corruption and Buffer Overflow

Released on: 2013-06-03
Updated on:

Affected Systems:
Sketchup 8.x
Sketchup 7.x
Sketchup 6
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2013-3664
 
SketchUp is a 3D model program launched by Trimble Navigation Limited.
 
There are multiple security vulnerabilities in the implementation of SketchUp 8-Maintenance 5 (8.0.16846). After successful exploitation, attackers can execute arbitrary code on the premise that the user is tempted to open a malicious SKP file. These vulnerabilities are caused by memory corruption caused by specially crafted SKP files and boundary errors in the RLE4 compressed bitmap in the SKP file, resulting in heap buffer overflow.
 
<* Source: Juan Pablo "El Lagarto" De Francesco

Link: http://secunia.com/advisories/53635/
Http://www.binamuse.com/advisories/BINA-20130521A.txt
Http://www.binamuse.com/advisories/BINA-20130521B.txt
Http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Http://www.binamuse.com/exploits/BINA-20130521B-POC-WIN.zip

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Sketchup
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.sketchup.com/products/sketchup-pro/new-in-2013