ChemViewX v1.9.5 ActiveX Control Mutliple Stack Overflows

                                                     (    , )     (,
  .   `.' ) ('.    ',
   ). , ('.   ( ) (
  (_,) .`), ) _ _,
 /  _____/  / _  \    ____  ____   _____  
 \____  \==/ /_\  \ _/ ___\/  _ \ /     \
 /       \/   |    \\  \__(  <_> )  Y Y  \
/______  /\___|__  / \___  >____/|__|_|  /
        \/         \/.-.    \/         \/:wq
                    (x.0)
                  '=.|w|.='
                  _='`"``=.

        presents..

ChemviewX ActiveX Control Multiple Stack Overflows
Versions affected: v1.9.5

+-----------+
> Description|
+-----------+

Hyleos ChemviewX is a free ActiveX control used to visualize chemical
structures made from MDL or MOL files. The control is commonly used by
university students, organic, inorganic chemists, and chemical engineers.

The ClassID of the object is {C372350A-1D5A-44DC-A759-767FC553D96C} and 
the control is marked Safe For Scripting.
Two stack overflows were discovered in the ActiveX control, both
overflow conditions can be used to gain command execution.
    
+------------+
> Exploitation|
+------------+

Both stack overflow conditions relate to a fixed length buffer being used to
remove excessive whitespace characters from a supplied filename path.

The methods SaveasMolFile and ReadMolFile are both vulnerable to
a stack overflow condition which can be reached when supplying
more than 400 white-space characters in the filename argument.

Both tab and space characters can be used to trigger the overflow condition.
The 401-404th byte will result in the overflow of the call stack return address.
Both vulnerabilities can be used to gain command execution when combined
with a JavaScript heap spray when jumping into a pre-allocated heap.

+--------+
> Solution|
+--------+

The vendor was contacted multiple times over a two month period without any response.
Use of this control is not suggested as it appears to be unmaintained.
If you use this ActiveX control consider setting the kill bit for the control’s \
Classid ({C372350A-1D5A-44DCA759- 767FC553D96C}), or uninstalling the control.

+------+
> Credit|
+------+

Discovered and advised to Hyleos in December 2009 by Paul <dot> Craig - \
Security-Assessment.com This advisory is also available from our website:
http://www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Activex.pdf

Security-Assessment.com is a New Zealand based world leader in web application \
testing, network security and penetration testing. Security-Assessment.com works with \
organisations across New Zealand, Australia, Asia Pacific, the United States and the \
United Kingdom.