<<< Date Index >>>     <<< Thread Index >>>

[Bkis-07-2009] 010 Editor Multiple Buffer Overflow Vulnerabilities



010 Editor Multiple Buffer Overflow Vulnerabilities

1. General Information

010 Editor is a text editor and hex editor, with a lot of functions as view and edit binary files, analyze and edit binary data, import and export binary data in many different formats.

Bkis has just found many vulnerabilities in the software, related to the processing of 010 Editor Binary Template files (“.bt”) and 010 Editor Script Files (“.1sc”). These vulnerabilities are very dangerous due to the fact that they allow hackers to execute malicious code on users’ systems.

We’ve reported to the vendor about the errors and they’ve released a fixed version. All related information can be reached at: http://www.sweetscape.com/010editor/release_notes.html

Details : http://security.bkis.vn/?p=580
Bkis Advisory : Bkis-07-2009
Initial vendor notification : 03/04/2009
Release Date : 04/22/2009
Update Date : 04/22/2009
Discovered by : Le Duc Anh - Bkis
Attack Type : Buffer Overflow
Security Rating : Critical
Impact : Code Execution
Affected Software : 010 Editor Version <= 3.0.4
PoC : http://security.bkis.vn/wp-content/uploads/2009/04/010editor_v304_poc.zip

2. Technical Description

Binary Template and Script files are advertised as highlighted features of 010 Editor. Binary Template files help users parse and edit many types of binary files and Script files let users perform automatic tasks. The software has not handled these file formats well enough resulting in a lot of serious vulnerabilities.

Many fields in those two file formats might create buffer overflow errors when set with an overly long value. More precisely, errors can occur in the handling of the following fields and elements:
• Struct name in “.bt” files
• Custom attributes in “.bt” files
• Number format (a number prefixed by “0x”, or something else) in both “.bt” and “.1sc” files
• Mathematics operators in both “.bt” and “.1sc” files
• Function name in “.1sc” files
• Function parameters in “.1sc” files

In order to exploit, a hacker might create a specially crafted “.bt” or “.1sc” file and trick users into using it. If successful, hackers can perform local attack, inject viruses, steal sensitive information and even take control of the victim’s system.

3. Solution

The producer has fixed the vulnerability in 010 Editor Version 3.0.5. Rating this vulnerability high severity, Bkis recommends that users should update their software to the latest version.