Chance-i DiViS-Web DVR System - ActiveX Control Heap Overflow (PoC)

Digital Security Research Group DSecRG Advisory DSECRG-09-035 original advisory: http://dsecrg.com/pages/vul/DSECRG-09-035.html Application: Chance-i DiViS-Web DVR System ActiveX control Versions Affected: 3,0,0,7 Vendor URL: http://www.chance-i.com/ Bug: Heap Overflow Exploits: YES Reported:...

IntraLaunch ActiveX控件多个方式不安全调用漏洞

BUGTRAQ ID: 34395 CVECAN ID: CVE-2009-0218 IntraLaunch ActiveX控件允许网页链接本地或跨网络执行Word或PDF等文档所关联的应用程序。 IntraLaunch ActiveX控件（由IntraLaunch.ocx提供）没有限定到特定的域或Internet Explorer区，这允许任何站点都可以在安装了该控件的系统上通过调用该控件导致运行任意代码。 Particle Software IntraLaunch Particle Software -----------------...

CVE-2008-6638

Insecure method vulnerability in the Versalsoft HTTP Image Uploader ActiveX control UUploaderSvrD.dll 6.0.0.35 allows remote attackers to delete arbitrary files via the RemoveFileOrDir method...

CVE-2008-6638

The CVE-2008-6638 entry concerns the Versalsoft HTTP Image Uploader ActiveX control. The affected component is UUploaderSvrD.dll version 6.0.0.35, and the vulnerability arises from an insecure method that allows an attacker to delete arbitrary files via the RemoveFileOrDir function. This is a cli...

CVE-2008-6638

Insecure method vulnerability in the Versalsoft HTTP Image Uploader ActiveX control UUploaderSvrD.dll 6.0.0.35 allows remote attackers to delete arbitrary files via the RemoveFileOrDir method...

Particle Software IntraLaunch ActiveX控件远程代码执行漏洞

BUGTRAQ ID: 34395 CNCAN ID：CNCAN-2009040703 Particle Software IntraLaunch是一款允许WEB页链接来执行应用程序，如word或acrobat PDF文档而没有任何安全提示的ActiveX控件。 Particle Software IntraLaunch不正确限制访问危险方法，远程攻击者可以利用漏洞以应用程序权限执行任意命令。 问题存在于IntraLaunch.ocx提供的IntraLaunch ActiveX控件中，构建恶意的WEB页，诱使用户打开，可以应用程序权限执行任意命令。 Particle Software...

Particle Software IntraLaunch Application Launcher ActiveX control fails to restrict access to dangerous methods

Overview The Particle Software IntraLaunch Application Launcher ActiveX control allows arbitrary code execution. Description Particle Software IntraLaunch is an ActiveX control that "... allows web page links to execute anything from applications to associations such as Word or Acrobat PDF...

Autodesk IDrop ActiveX Control Heap Corruption

The IDrop ActiveX control, a utility from Autodesk that provides the ability to drag and drop web content into a drawing session, is installed on the remote Windows host. Manipulation of the control's 'Src', 'Background', and 'PackageXml' properties reportedly can be abused to trigger a...

Autodesk IDrop ActiveX控件多个堆溢出漏洞

BUGTRAQ ID: 34352 I-drop功能是Autodesk公司产品中所提供的技术，允许用户从Internet上将纹理、灯光、模型等对象直接拖到设计环境中。 为了实现I-drop技术，用户需要安装i-drop indicator程序。该程序所提供的Autodesk IDrop ActiveX控件（IDrop.ocx）没有正确地验证用户对Src、Background和PackageXml属性所传送的参数。如果用户受骗访问了恶意网页并向上述属性传送了超长参数，就可以触发堆溢出，导致执行任意代码。 Autodesk IDrop ActiveX 17.1.51.160 临时解决方法：...

Autodesk IDrop ActiveX multiple memory corruptions

Memory corruptions with different properties...

Autodesk IDrop ActiveX Control Heap Corruption Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Who: Autodesk http://www.autodesk.com What: Autodesk IDrop ActiveX Control http://usa.autodesk.com/adsk/servlet/index?siteID=123112&id=2753219& linkID=9240618 IDrop.ocx version 17.1.51.160 21E0CB95-1198-4945-A3D2-4BF804295F78 How: The Src, Background,...

PrecisionID Data Matrix Barcode ActiveX控件任意文件覆盖漏洞

BUGTRAQ ID: 34322 CVECAN ID: CVE-2009-1212 PrecisionID Data Matrix是用于生成二维条码的工具。 PrecisionID所提供的DMATRIXLib.Datamatrix ActiveX控件没有正确地验证用户对SaveBarCode和SaveEnhWMF方式所提交的输入参数： Sub SaveBarCode ByVal path As String Sub SaveEnhWMF ByVal path As String 如果用户受骗访问了恶意网页并向上述方式传送了恶意参数的话，就可能导致向系统上任意位置写入文件。...

Autodesk IDrop ActiveX Control Heap Memory Corruption

This module exploits a heap-based memory corruption vulnerability in Autodesk IDrop ActiveX control IDrop.ocx version 17.1.51.160. An attacker can execute arbitrary code by triggering a heap use after free condition using the Src, Background, PackageXml properties. Module Options msf use...

SAP AG WebViewer3D ActiveX控件栈溢出漏洞

BUGTRAQ ID: 34310 CVECAN ID: CVE-2007-4475,CVE-2009-1205 SAPgui是SAP软件的图形用户界面客户端。 SAPgui提供了一个名为EAI WebViewer3D的ActiveX控件（webviewer3d.dll），该控件没有正确地验证对 SaveViewToSessionFile方式所传送的参数。如果用户受骗访问了恶意网页并向该方式传送了超长参数的话，就可以触发栈溢出，导致执行任意代码。 SAP Sapgui 7.10 Patch Level 8 临时解决方法： 在IE中禁用EAI WebViewer3D...

CVE-2007-4475

Stack-based buffer overflow in EAI WebViewer3D ActiveX control webviewer3d.dll in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method...

Stack overflow

Stack-based buffer overflow in EAI WebViewer3D ActiveX control webviewer3d.dll in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method...

CVE-2007-4475

Summary: CVE-2007-4475 describes a stack-based buffer overflow in the EAI WebViewer3D ActiveX control (webviewer3d.dll) bundled with SAPgui. The vulnerability arises when processing a long argument to the SaveViewToSessionFile method, enabling remote code execution. Affected software/versions: SA...

Design/Logic Flaw

Multiple insecure method vulnerabilities in PRECIS2.DLL in the PrecisionID Datamatrix ActiveX control DMATRIXLib.Datamatrix allow remote attackers to overwrite arbitrary files via the 1 SaveBarCode and 2 SaveEnhWMF methods...

CVE-2009-1212

Multiple insecure method vulnerabilities in PRECIS2.DLL in the PrecisionID Datamatrix ActiveX control DMATRIXLib.Datamatrix allow remote attackers to overwrite arbitrary files via the 1 SaveBarCode and 2 SaveEnhWMF methods...

CVE-2009-1212

PrecisionID Data Matrix ActiveX control (DMATRIXLib.Datamatrix) contains insecure input validation in SaveBarCode and SaveEnhWMF, enabling remote arbitrary file writes. Affected component: PRECIS~2.DLL within PrecisionID Data Matrix ActiveX. Impact: potential overwrite of arbitrary files on the h...