Libungif Exploit Found!!! - PSP3D.com - Sony PlayStation Portable News, Homebrew, Hacks, Reviews, Videos, Mods, Forums

Twitch · #1 (**permalink**) 12-08-2005, 04:08 PM

OK

On pspupdates its been anounced that appearantly an exploit has been found in libungif, in versions below 4.1.4(released 10-19-2005)

Heres the link to the thread--->http://forums.qj.net/showthread.php?t=28627

Heres a link to Info about the exploit:
http://www.frsirt.com/english/advisories/2005/2295

..and some "proof-of-concept" GIFs
http://scary.beasts.org/misc/bad1.gif
http://scary.beasts.org/misc/bad2.gif
http://scary.beasts.org/misc/bad3.gif

Heres what is known:

GIFs "bad1" and "bad2" cause fw versions 2.01 and 2.5 to "freeze" and shut themselves down.

GIF "bad3" doesnt cause 2.01 to crash but once you select it you get error code 00000001(I dont know about 2.5)

These dont work on 2.6. That fw has been patched.

This exploit has led to code execution on computers.

Fanjita on pspupdates wrote this:

Quote:

Exploiting this one isn't straightforward.

It's being looked at, but due to the nature of the vulnerability (heap vs stack overflow, for a start), it's far from simple.

I'm hoping something will come of this, but don't hold your breath.

Incidentally, it looks like if it can be made to work, it would be good for at least 2.01 and 2.5. 2.6 seems to have fixed it, from what I remember.

And this:

Quote:

It's been confirmed as fixed on 2.6 (and it makes sense, since the publicly-known vulnerability was fixed in libungif between the 2.5 and 2.6 release dates).

To my knowledge it's not been discussed in any open forums. Most of the places that house sufficient knowledge to discuss this sort of thing productively don't like discussing exploits. And most decent hackers don't like to raise people's hopes before something has come of their ideas .

Rest assured that it is being explored by talented coders, and that there's a decent chance of it turning out to be useful. But it's far from pretty to work with.

Just thought everyone should see this.......

-Peace

dadon · #2 (**permalink**) 12-08-2005, 04:15 PM

Quote:

Originally Posted by Twitch

OK

On pspupdates its been anounced that appearantly an exploit has been found in libungif, in versions below 4.1.4(released 10-19-2005)

Heres the link to the thread--->http://forums.qj.net/showthread.php?t=28627

Heres a link to Info about the exploit:
http://www.frsirt.com/english/advisories/2005/2295

..and some "proof-of-concept" GIFs
http://scary.beasts.org/misc/bad1.gif
http://scary.beasts.org/misc/bad2.gif
http://scary.beasts.org/misc/bad3.gif

Heres what is known:

GIFs "bad1" and "bad2" cause fw versions 2.01 and 2.5 to "freeze" and shut themselves down.

GIF "bad3" doesnt cause 2.01 to crash but once you select it you get error code 00000001(I dont know about 2.5)

These dont work on 2.6. That fw has been patched.

This exploit has led to code execution on computers.

Fanjita on pspupdates wrote this:

And this:

Just thought everyone should see this.......

-Peace

could anything be done with this then?
it looks legit

Twitch · #3 (**permalink**) 12-08-2005, 04:38 PM

Quote:

Originally Posted by dadon

could anything be done with this then?
it looks legit

Well, this exploit has been used to execute code on computers.

so.....

If we can use this to get code to run on a PSP then we could have a possible downgrader in our hands, but like Fanjita said, its not a simple matter(google 'smash the stack for fun and profit') this is a "heap" overflow, not "stack" like the .tif exploit.

So dont hold your breath. It may be a while......if ever.

Heres to hope

dadon · #4 (**permalink**) 12-08-2005, 04:45 PM

Quote:

Originally Posted by Twitch

Well, this exploit has been used to execute code on computers.

so.....

If we can use this to get code to run on a PSP then we could have a possible downgrader in our hands, but like Fanjita said, its not a simple matter(google 'smash the stack for fun and profit') this is a "heap" overflow, not "stack" like the .tif exploit.

So dont hold your breath. It may be a while......if ever.

Heres to hope

ooohhh. kk. hope for the best

pcfil · #5 (**permalink**) 12-08-2005, 04:49 PM

It is legit. It freezed my 2.01 and my 2.5.
Hope any codes will come quickly.

psplover · #6 (**permalink**) 12-08-2005, 05:13 PM

it just freezed my psp, and it done. so what can i do with this one......

R3x_f3star · #7 (**permalink**) 12-08-2005, 05:22 PM

weyhey, gd work. basically wat happends next? n e 1 wanna exp

Twitch · #8 (**permalink**) 12-08-2005, 05:26 PM

Quote:

Originally Posted by psplover

it just freezed my psp, and it done. so what can i do with this one......

With a known exploit (on computers) already lined out, this is good news for coders. The version of libungif that's exploitable is used on PSP fw 2.0-->2.50

With a general concept of how this exploit works it is easier for coders to determine whether or not this is usable on PSP.

The fact that this "exploit" crashes firmwares 2.00->2.50, but was patched for the 2.60 release is promising, as far as this being a possible security flaw goes.

But to answer your question, what can you do with this one?

Right now.....nothing