=================================================================
Title: Sketchup MAC Pict Material Palette Stack Corruption
Product: Trimble SketchUp
Advisory ID: BINA-20130521A
CVE ID: CVE-2013-3664
Class: Boundary Error Condition (Buffer Overflow)
Vulnerability class: Client side/ file format
Permalink: https://binamuse.com/advisories/BINA-20130521A.txt
Vendor notified on: 2013-04-18
Patch/Fix Released: 2013-05-21
Advisory Published: 2013-05-23

Vulnerability Description:

 SketchUp is a 3D modeling program marketed by Trimble Navigation Limited
 and designed for architectural, civil, and mechanical engineers as well
 as filmmakers, game developers, and related professions.

 SketchUp fails to validate the input when parsing an embedded MACPict
 texture. Arbitrary code execution is proved possible after a malicious
 texture or thumbnail or background image triggers a stack overflow.
 The issue can also be triggered when Windows Explorer reads the embedded
 thumbnail in a .skp file.

Vulnerable Packages:

 SketchUp 8 - Maintenance 5 - Win 8.0.16846 Mac 8.0.16845
 SketchUp 8 - Maintenance 4 - Win 8.0.15158 Mac 8.0.15157
 SketchUp 8 - Maintenance 3
 SketchUp 8 - Maintenance 2
 SketchUp 8 - Maintenance 1
 SketchUp 8
 SketchUp 7.1 - Maintenance 2
 SketchUp 7.1 - Maintenance 1
 SketchUp 7.1
 SketchUp 7     - Maintenance 1
 SketchUp Pro 6 - Maintenance 6

Not Vulnerable Packages:

 Sketchup 2013

Solution/Vendor Information/Workaround:

 Upgrade to Sketchup 2013
 URL: https://www.sketchup.com/products/sketchup-pro/new-in-2013

  For other version of the software contact vendor for an appropriate
  fix.

Credits:

 This vulnerability was found by Juan Pablo "El Lagarto" De Francesco of the
 Binamuse Vulnerability Research Team, https://binamuse.com

Technical Description:

 The native SketchUp fileformat can handle textured 3D content.
 Sketchup can create realistic materials taken from image files such as .jpg
 pictures taken with a digital camera. A number of this images can be embedded
 into the main .skp file and loaded every time the 3D scene is open.

 The bug is triggered when SketchUp loads the color palette table of a
 MAC Pict material (or embedded image).

 A MAC Pict file can hold palettes of up to 64k colors. It is encoded so the
 number of colors to read from the file is the first 16bit unsigned value of the
 encoded palette.

   '>H'  numColors

 Then it follows a list of up to numColors palette entries.

   [
     '>H'  color index
     'BBB' RGB
   ] * numColors

 Each entry is a pair of index and RGB color and the entries can be put in any
 order. The only constraint is that each index must be less or equal
than numColor.
 SketchUp reads this potentially 64k entries length table in a 256
entries length
 stack buffer.

 Thus, is fair to say that an almost arbitrary offset of the stack can
be written
 with an almost arbitrary value. Playing with the stacked local values of the
 calling functions it is possible to capture the execution flow and execute
 arbitrary code.

 Exploitation of the above problem will lead to the execution of arbitrary
 code on the client machine with the privileges of the user running the
 Sketchup.

REFERENCES:

 https://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html
 https://binamuse.com/advisories/BINA-20130521B.txt

DISCLAIMER:

 The content of this advisory are copyright (c) 2013 Binamuse Inc.
 and may be distributed freely provided that no fee is charged for this
 distribution and proper credit is given.