XUpload ActiveX Control AddFolder Method Buffer Overflow

The remote host contains a version of the XUpload ActiveX control from Persits Software that reportedly is affected by a buffer overflow in its 'AddFolder' method that can be triggered by a long argument. If a remote attacker can trick a user on the affected host into visiting a specially crafted...

persists-addfolder.txt

I took a shot at writing an exploit for this, so here goes. Choice of WinExecthe calculator, what else? or a bindshell. ------------------------------- Persits Software XUpload Control AddFolder BoF Exploit function Check var buf = 'A'; while buf.length = 1387 buf = buf + 'A'; // win32exec -...

Persits Software XUpload Control AddFolder() Buffer Overflow Exploit

No description provided by source. !-- written by e.b. Persits Software XUpload Control AddFolder Buffer Overflow Exploit Tested on Windows XP SP2fully patched English, IE6 and IE7 Thanks to h.d.m. and the Metasploit crew -- html head titlePersits Software XUpload Control AddFolder BoF...

Persists Software XUpload ActiveX control buffer overflow

Buffer overflow in AddFolder method...

[Full-disclosure] Persits Software XUpload Control AddFolder() Buffer Overflow Exploit

I took a shot at writing an exploit for this, so here goes. Choice of WinExecthe calculator, what else? or a bindshell. ------------------------------- !-- written by e.b. Persits Software XUpload Control AddFolder Buffer Overflow Exploit Exploit Tested on Windows XP SP2fully patched English, IE6...

[Full-disclosure] Persits Software XUpload Control Buffer Overflow Exploit

I tried posting this yesterday, don't know what happened, anyhow, my advance apologies for any double posts. I took a shot at writing an exploit for this, so here goes. Code is inline and attached. ------------------------- !-- written by e.b. Persits Software XUpload Control AddFolder Buffer...

persists-overflow.txt

There is a buffer overflow in the AddFolder method of the Persists Software XUpload control, version 2.1.0.1. This object is marked safe for scripting. Version 3.0latest is not vulnerablethrows an error if the parameter is more than 256 characters, I have not tested any other versions. A quick...

Persits Software XUpload Control AddFolder() Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ==================================================================== Persits Software XUpload Control AddFolder Buffer Overflow Exploit ==================================================================== Persits Software XUpload Control...

Persits Software XUpload ActiveX控件远程栈溢出漏洞

BUGTRAQ ID: 27025 XUpload是功能强大的客户端上传ActiveX控件，允许用户同时上传多个文件。 XUpload ActiveX控件（XUpload.ocx）在处理传送给AddFolder方式的参数时存在栈溢出漏洞，如果用户受骗访问了恶意站点并向该方式传送了超长参数的话，就可能触发这个溢出，导致执行任意指令。 Persits XUpload 2.1.0.1 厂商补丁： Persits ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://xupload.aspupload.com/ html...

Persits Software XUpload Control - AddFolder() Remote Buffer Overflow

Persits Software XUpload Control - AddFolder Remote Buffer Overflow Persits Software XUpload Control AddFolder BoF Exploit function Check var buf = 'A'; while buf.length = 1387 buf = buf + 'A'; // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2...

Persits Software XUpload Control - 'AddFolder()' Remote Buffer Overflow

Persits Software XUpload Control AddFolder BoF Exploit function Check var buf = 'A'; while buf.length = 1387 buf = buf + 'A'; // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 =...

CVE-2007-6530

Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1, and probably other versions before 3.0, as used by HP Mercury LoadRunner and Groove Virtual Office, allows remote attackers to execute arbitrary code via a long argument to the AddFolder function...

DSquare Exploit Pack: D2SEC_XUPLOAD

Name| d2secxupload ---|--- CVE| CVE-2007-6530 Exploit Pack| D2ExploitPack Description| Persits Software XUpload ActiveX Stack Overflow Notes|...

CVE-2007-6530

CVE-2007-6530 : Buffer overflow in Persits Software XUpload ActiveX control (AddFolder method) allows remote code execution via a long argument. Affected: XUpload 2.1.0.1 and likely earlier versions (pre-3.0). Products listed in description include HP Mercury LoadRunner and Groove Virtual Office....

Groove Virtual Office XUpload ActiveX控件缓冲区溢出漏洞

Groove Virtual Office是一款协同办公处理文档的应用程序。 Groove Virtual Office包含的XUpload ActiveX控件存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 XUpload ActiveX控件对"AddFolder"方法缺少正确的边界错误，构建恶意的WEB页，诱使用户访问，可触发缓冲区溢出，精心构建提交数据可能以应用程序进程权限执行任意指令。 Groove Virtual Office 3.x Office Groove 2007不受此漏洞影响：...

Mercury LoadRunner XUpload ActiveX控件缓冲区溢出漏洞

BUGTRAQ ID: CNCAN ID:CNCAN-2007122709 Mercury LoadRunner是一款预测系统行为和性能的负载测试工具。 Mercury LoadRunner包含的XUpload ActiveX控件存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 XUpload ActiveX控件对"AddFolder"方法缺少正确的边界错误，构建恶意的WEB页，诱使用户访问，可触发缓冲区溢出，精心构建提交数据可能以应用程序进程权限执行任意指令。 HP LoadRunner 9.x Mercury LoadRunner 8.x --------...

CVE-2007-6530: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1, and probably other versions before 3.0, as used by HP Mercury LoadRunner and Groove Virtual Office, allows remote attackers to execute arbitrary code via a long argument to the AddFolder function...