Attack Chain

1. Attacker gains local access to a Windows system with SocuSoft iPod Photo Slideshow 8.05 installed.
2. Attacker launches the SocuSoft iPod Photo Slideshow application.
3. Attacker navigates to the registration dialog within the application.
4. Attacker enters a malicious string into the “Registration Name” field exceeding the expected buffer size.
5. Attacker enters a malicious string into the “Registration Key” field exceeding the expected buffer size.
6. The application attempts to process the overly long input strings, causing a stack-based buffer overflow.
7. The structured exception handler (SEH) is overwritten with attacker-controlled data, pointing to malicious code.
8. When an exception occurs (triggered by the overflow), control is transferred to the overwritten SEH, resulting in the execution of arbitrary code, such as a reverse shell.

Impact

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code on the targeted system. This could lead to complete system compromise, including the installation of malware, exfiltration of sensitive data, and denial of service. Since the attacker gains the privileges of the user running the application, impact is dependent on user permissions.

Recommendation

• Block execution of SocuSoft iPod Photo Slideshow 8.05 until a patch is available to prevent exploitation of CVE-2018-25375.
• Monitor process creation events for unexpected processes spawned by iPodPhotoSlideshow.exe to detect potential exploitation attempts using the rule below.