MOAUB #30 – Microsoft Unicode Scripts Processor Remote Code Execution (MS10-063)

Usp10.dll module in windows and office is responsible for parsing Unicode strings. In this module there are two functions named GetCmapFontPagesPresent and LoadCmapFontGlyphs and these functions are responsible for parsing cmap table in Open Type and True Type font.

By cmap table mapping between character codes and glyph index values is established. You can get information about file formats Open Type fonts and cmap table use the following address:

Our vulnerabilities exist in both functions and could be trigger in same way. In this analysis we will examine GetCmapFontPagesPresent function.

Cmap table for mapping operations to be able to do different characters is a different subtable. All Microsoft Unicode BMP encodings should at least have a subtable Format 4. If the font wants more support unicode characters to the Format 12 subtable also need to find. Function at the beginning GetCmapFontPagesPresent, this case is controlled by whether the desired type of subtable 12 (0xC) is or type 4 (0×4).

Structure Format 12 subtable (Segmented coverage) is as follows:

Structure of the groups is as follows:

More code amount is controlled field nGroups whether is greater than 0 or not.

Then the size field value nGroups, we ring the different groups to assess quality. In each group, according to the values and fields startCharCode endCharCode, another ring have done the calculation and the calculation result is stored in the buffer.

Vulnerable point of the code, lack of control levels nGroups Field Format 12 subtable and Hmchynyn startCharCode fields and values of each group is endCharCode that can be caused Array Indexing Vulnerability.

According to the description above, if the values of fields endCharCode startCharCode and set the ring can be created with high numbers can cause stack overflow in the log.But we rewrite the return address or structure of SEH, have limitations. Because according to the loop processing operation Producer groups, values are Baznvsy amounts are limited.

We propose trigger this vulnerability through a html page. StartCharCode fields and values you need to somehow adjust endCharCode record structure of SHE, SEH Handler overwriting so that the suffering be the address from a . NET dll technology load on. then Write your shellcode within the DLL we have. Thus occur as soon as you can run an Exception to the desired location in the DLL where the shellcode is available.

Check out the Microsoft Unicode Scripts Processor Remote Code Execution Exploit.