MPEG2 0DAY Vulnerability Analysis Report

This vulnerability is manifested in MSVidCtl. dll (xpsp2: 6.5.2600.2180, vista: 6.5.6000.16386). MSVidCtl. dll is the system standard component. The cause of the vulnerability is that the persistent byte array (VT_UI1 | VT_ARRAY) is incorrectly read. Attackers can construct special files to trigger this vulnerability, which leads to arbitrary code execution with the current process permission.

The following is an analysis of the vulnerability code:
Take MSVidCtl. dll of 6.5.2600.2180 as an example:

. Text: 59F0D5E3 push edi
. Text: 59F0D5E4 mov edi, [ebp + arg_3C]
. Text: 59F0D5E7 mov eax, [edi]
. Text: 59F0D5E9 push ebx
. Text: 59F0D5EA push 2
. Text: 59F0D5EC lea ecx, [ebp + vt]
. Text: 59F0D5EF push ecx
. Text: 59F0D5F0 push edi
. Text: 59F0D5F1 call dword ptr [eax + 0Ch]
. Text: 59F0D5F4 cmp eax, 1
. Text: 59F0D5F7 jnz short loc_59F0D5FE
. Text: 59F0D5F9 mov eax, 80004005 h

At 0x59F0D5F1, 2 bytes are read to determine the type of the read VARIANT (VARTYPE ).

. Text: 59F0D67F cmp eax, 2011 h
. Text: 59F0D684 jnz loc_59F0D70E
. Text: 59F0D68A mov eax, [edi]
. Text: 59F0D68C push ebx
. Text: 59F0D68D push 8
. Text: 59F0D68F lea ecx, [ebp + cElmts]
. Text: 59F0D692 push ecx
. Text: 59F0D693 push edi
. Text: 59F0D694 call dword ptr [eax + 0Ch]
. Text: 59F0D697 cmp eax, ebx
. Text: 59F0D699 jl loc_59F0D760
. Text: 59F0D69F cmp eax, 1

Next, start from 0x59F0D68A and enter the process of VARTYPE being 2011 h, that is, VT_UI1 | VT_ARRAY: 8 bytes are read at 0x59F0D694, however, only 32 bits are used to determine the size of the byte array.

. Text: 59F0D6AE mov eax, [ebp + cElmts]
. Text: 59F0D6B1 mov [ebp-20h], eax
. Text: 59F0D6B4 lea eax, [ebp-20h]
. Text: 59F0D6B7 push eax; rgsabound
. Text: 59F0D6B8 push 1; cDims
. Text: 59F0D6BA push 11 h; vt
. Text: 59F0D6BC mov [ebp + rgsabound. lLbound], ebx
. Text: 59F0D6BF call ds: SafeArrayCreate
. Text: 59F0D6C5 mov ebx, eax
. Text: 59F0D6C7 test ebx, ebx
. Text: 59F0D6C9 jnz short loc_59F0D6D5

Then, construct the SAFEARRAYBOUND structure at 0x59F0D6B1 (store the number of previously read data in this structure) and call SafeArrayCreate to create the SAFEARRAY structure.

. Text: 59F0D6D5 lea eax, [ebp + pvData]
. Text: 59F0D6D8 push eax; ppvData
. Text: 59F0D6D9 push ebx; psa
. Text: 59F0D6DA call ds: SafeArrayAccessData
. Text: 59F0D6E0 test eax, eax
. Text: 59F0D6E2 jl short loc_59F0D760
. Text: 59F0D6E4 mov eax, [edi]
. Text: 59F0D6E6 push 0
. Text: 59F0D6E8 push [ebp + cElmts]
. Text: 59F0D6EB lea ecx, [ebp + pvData]
. Text: 59F0D6EE push ecx