ChemviewX 1.9.5 ActiveX Control Multiple Stack Overflows

2010.02.14
Credit: null
Risk: High
Local: No
Remote: Yes
CWE: CWE-119


CVSS Base Score: 9.3/10
Impact Subscore: 10/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

( , ) (, . `.' ) ('. ', ). , ('. ( ) ( (_,) .`), ) _ _, / _____/ / _ \ ____ ____ _____ \____ \==/ /_\ \ _/ ___\/ _ \ / \ / \/ | \\ \__( <_> ) Y Y \ /______ /\___|__ / \___ >____/|__|_| / \/ \/.-. \/ \/:wq (x.0) '=.|w|.=' _='`"``=. presents.. ChemviewX ActiveX Control Multiple Stack Overflows Versions affected: v1.9.5 +-----------+ |Description| +-----------+ Hyleos ChemviewX is a free ActiveX control used to visualize chemical structures made from MDL or MOL files. The control is commonly used by university students, organic, inorganic chemists, and chemical engineers. The ClassID of the object is {C372350A-1D5A-44DC-A759-767FC553D96C} and the control is marked Safe For Scripting. Two stack overflows were discovered in the ActiveX control, both overflow conditions can be used to gain command execution. +------------+ |Exploitation| +------------+ Both stack overflow conditions relate to a fixed length buffer being used to remove excessive whitespace characters from a supplied filename path. The methods SaveasMolFile and ReadMolFile are both vulnerable to a stack overflow condition which can be reached when supplying more than 400 white-space characters in the filename argument. Both tab and space characters can be used to trigger the overflow condition. The 401-404th byte will result in the overflow of the call stack return address. Both vulnerabilities can be used to gain command execution when combined with a JavaScript heap spray when jumping into a pre-allocated heap. +--------+ |Solution| +--------+ The vendor was contacted multiple times over a two month period without any response. Use of this control is not suggested as it appears to be unmaintained. If you use this ActiveX control consider setting the kill bit for the control?s Classid ({C372350A-1D5A-44DCA759- 767FC553D96C}), or uninstalling the control. +------+ |Credit| +------+ Discovered and advised to Hyleos in December 2009 by Paul <dot> Craig - Security-Assessment.com This advisory is also available from our website: http://www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Activex.pdf Security-Assessment.com is a New Zealand based world leader in web application testing, network security and penetration testing. Security-Assessment.com works with organisations across New Zealand, Australia, Asia Pacific, the United States and the United Kingdom.

References:

http://www.securityfocus.com/bid/38225
http://www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Activex.pdf
http://www.exploit-db.com/exploits/11422
http://secunia.com/advisories/38523
http://packetstormsecurity.org/1002-exploits/hyleoschemview-heap.rb.txt
http://packetstormsecurity.org/1002-advisories/chemviewx-overflow.txt
http:1584//osvdb.org/62276


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top