Bugtraq mailing list archives
Taltech Tal Bar Code ActiveX Control Memory Corruption Vulnerability(-ies)
From: "sapheal-hack.pl" <sapheal () hack pl>
Date: Sat, 5 May 2007 20:55:15 +0200
Taltech Tal Bar Code ActiveX Control Memory Corruption Vulnerability(-ies)
Michal Bucko (sapheal) hack.pl I. BACKGROUND The Bar Code ActiveX Control has all the features necessary to easily addprofessional quality barcodes to any Windows application including Web pages, database reporting and labeling, product packaging, document tracking, postal
bar coding and special purpose bar code labeling applications.It is an extremely easy and powerful tool that will work flawlessly with any Windows application that supports ActiveX technology including Visual Basic,
C++, Internet Explorer Web pages, Microsoft Word, Excel, Access, etc. II. DESCRIPTION The vulnerability lies in SaveBarCode function. The vulnerability allowsarbitrary code execution (in the context of current user) via a web browser.
The debug snippet shows what happened to the default exception handler: 41414141 Pointer to next SEH record 41414141 SE Handler Return address and default exception handler were overwritten. The other interesting vulnerability (but much of a different character, though) allows storage of files on the remote machine. The files contain bar codes, however, such an issue might be exploited to store thousands offiles on the remote machine. The sample exploit for the second vulnerability
is very simple and looks the following way (windows script file [wsf]): <?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:C917E12F-9757-11D2-85DB-F01851C10000' id='target' /> <script language='vbscript'> arg="somefilename" target.SaveBarCode arg </script></job></package>
Current thread:
- Taltech Tal Bar Code ActiveX Control Memory Corruption Vulnerability(-ies) sapheal-hack.pl (May 07)