RealNetworks RealGames StubbyUtil.ShellCtl.1 ActiveX Control Multiple Remote Command Execution

                                                RealNetworks RealGames StubbyUtil.ShellCtl.1 ActiveX Control 
(InstallerDlg.dll v2.6.0.445) Multiple Remote Commands Execution 
and Code Execution Vulnerabilities

tested against Internet Explorer 9, Vista sp2

download url: http://www.gamehouse.com/

background:

When choosing to play with theese online games ex. the game called
"My Farm Life" (see url: http://www.gamehouse.com/download-games/my-farm-life )
you download an installer called GameHouse-Installer_am-myfarmlife_gamehouse_.exe

This setup program installs an ActiveX with the following settings:

CLSID: {80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}
Progid: StubbyUtil.ShellCtl.1
Binary Path: C:\Program Files\RealArcade\Installer\bin\InstallerDlg.dll
Safe For Initialization (Registry): True
Safe For Scripting (Registry): True

This control is safe for scripting and safe for initialization,
so Internet Explorer will allow scripting of this control from
remote.

vulnerability:

This control has four methods implemented insecurely:

ShellExec()      -> allows to launch arbitrary commands
ShellExecRunAs() -> allows to launch arbitrary commands
CreateShortcut() -> allows to create arbitrary executable files inside the automatic
                    startup folders
CopyDocument()   -> allows to copy arbitrary executable files from a remote
                    network share to local folders, ex. automatic startup folders

other attacks are possible including information disclosure and file deletion, 
see typelib:

class IShellCtl { /* GUID={0D60A064-2009-4623-8FC1-F99CAC01037E} */
	/* DISPID=1610612736 */
	function QueryInterface(
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_PTR [26] [out] --> VT_PTR [26]  */ &$ppvObj 
		)
	{
	}
	/* DISPID=1610612737 */
	/* VT_UI4 [19] */
	function AddRef(
		)
	{
	}
	/* DISPID=1610612738 */
	/* VT_UI4 [19] */
	function Release(
		)
	{
	}
	/* DISPID=1610678272 */
	function GetTypeInfoCount(
		/* VT_PTR [26] [out] --> VT_UINT [23]  */ &$pctinfo 
		)
	{
	}
	/* DISPID=1610678273 */
	function GetTypeInfo(
		/* VT_UINT [23] [in] */ $itinfo,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_PTR [26] [out] --> VT_PTR [26]  */ &$pptinfo 
		)
	{
	}
	/* DISPID=1610678274 */
	function GetIDsOfNames(
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_PTR [26] [in] --> VT_PTR [26]  */ &$rgszNames,
		/* VT_UINT [23] [in] */ $cNames,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_PTR [26] [out] --> VT_I4 [3]  */ &$rgdispid 
		)
	{
	}
	/* DISPID=1610678275 */
	function Invoke(
		/* VT_I4 [3] [in] */ $dispidMember,
		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,
		/* VT_UI4 [19] [in] */ $lcid,
		/* VT_UI2 [18] [in] */ $wFlags,
		/* VT_PTR [26] [in] --> ? [29]  */ &$pdispparams,
		/* VT_PTR [26] [out] --> VT_VARIANT [12]  */ &$pvarResult,
		/* VT_PTR [26] [out] --> ? [29]  */ &$pexcepinfo,
		/* VT_PTR [26] [out] --> VT_UINT [23]  */ &$puArgErr 
		)
	{
	}
	/* DISPID=1 */
	function CreateShortcut(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$name,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$target,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$icon,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$workingDir,
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$args 
		)
	{
		/* method CreateShortcut */
	}
	/* DISPID=2 */
	function DeleteShortcut(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$name 
		)
	{
		/* method DeleteShortcut */
	}
	/* DISPID=3 */
	/* VT_BSTR [8] */
	function ModuleFileName(
		)
	{
		/* method ModuleFileName */
	}
	/* DISPID=4 */
	/* VT_BSTR [8] */
	function GetSpecialFolder(
		/* VT_UI4 [19] [in] */ $__MIDL_0025 
		)
	{
		/* method GetSpecialFolder */
	}
	/* DISPID=5 */
	/* VT_BOOL [11] */
	function CheckWnd(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0026 
		)
	{
		/* method CheckWnd */
	}
	/* DISPID=6 */
	/* VT_BSTR [8] */
	function ExistingTPS(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0028 
		)
	{
		/* method ExistingTPS */
	}
	/* DISPID=7 */
	function SetWorkingDir(
		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0030 
		)
	{
		/* method SetWorkingDir */
	}
	/* DISPID=8 */
	/* VT_BSTR [8] */
	function GetWorkingDir(
		)
	{
		/* method GetWorkingDir */
	}
	/* DISPID=9 */
	/* VT_R8 [5] */
	function OSVersion(
		)
	{
		/* method OSVersion */
	}
	/* DISPID=10 */
	/* VT_BSTR [8] */
	function GetSystemID(
		)
	{
		/* method GetSystemID */
	}
	/* DISPID=11 */
	function InstallFromCD(
		/* VT_BSTR [8] [in] */ $GameID,
		/* VT_BSTR [8] [in] */ $GameName,
		/* VT_BSTR [8] [in] */ $Tps,
		/* VT_BSTR [8] [in] */ $GameLang,
		/* VT_BSTR [8] [in] */ $CDPath,
		/* VT_BSTR [8] [in] */ $StoreFront 
		)
	{
		/* method InstallFromCD */
	}
	/* DISPID=12 */
	/* VT_UI4 [19] */
	function KillProcess(
		/* VT_BSTR [8] [in] */ $__MIDL_0033 
		)
	{
		/* method KillProcess */
	}
	/* DISPID=13 */
	function RefreshAddRemovePrograms(
		)
	{
		/* method RefreshAddRemovePrograms */
	}
	/* DISPID=14 */
	function ShellExec(
		/* VT_BSTR [8] [in] */ $FilePath,
		/* VT_BSTR [8] [in] */ $Params 
		)
	{
		/* method ShellExec */
	}
	/* DISPID=15 */
	function ShellExecRunAs(
		/* VT_BSTR [8] [in] */ $FilePath,
		/* VT_BSTR [8] [in] */ $Params 
		)
	{
		/* method ShellExecRunAs */
	}
	/* DISPID=16 */
	/* VT_BSTR [8] */
	function PlatformInfo(
		)
	{
		/* method PlatformInfo */
	}
	/* DISPID=17 */
	/* VT_BSTR [8] */
	function GetAvailableDrive(
		/* VT_INT [22] [in] */ $reqSpace 
		)
	{
		/* method GetAvailableDrive */
	}
	/* DISPID=18 */
	/* VT_BOOL [11] */
	function InitializeStamp(
		/* VT_BSTR [8] [in] */ $exeName,
		/* VT_INT [22] [in] */ $offset 
		)
	{
		/* method InitializeStamp */
	}
	/* DISPID=19 */
	/* VT_BSTR [8] */
	function GetContentID(
		)
	{
		/* method GetContentID */
	}
	/* DISPID=20 */
	/* VT_BSTR [8] */
	function GetTrackingID(
		)
	{
		/* method GetTrackingID */
	}
	/* DISPID=21 */
	/* VT_BSTR [8] */
	function GetAffiliate(
		)
	{
		/* method GetAffiliate */
	}
	/* DISPID=22 */
	/* VT_BSTR [8] */
	function GetCurrency(
		)
	{
		/* method GetCurrency */
	}
	/* DISPID=23 */
	/* VT_BSTR [8] */
	function GetPrice(
		)
	{
		/* method GetPrice */
	}
	/* DISPID=24 */
	/* VT_BSTR [8] */
	function GetTimestamp(
		)
	{
		/* method GetTimestamp */
	}
	/* DISPID=25 */
	/* VT_BSTR [8] */
	function GetOTP(
		)
	{
		/* method GetOTP */
	}
	/* DISPID=26 */
	/* VT_BOOL [11] */
	function CopyDocument(
		/* VT_BSTR [8] [in] */ $src,
		/* VT_BSTR [8] [in] */ $dest 
		)
	{
		/* method CopyDocument */
	}
	/* DISPID=27 */
	function InstallerToForeground(
		)
	{
		/* method InstallerToForeground */
	}
	/* DISPID=28 */
	function MonitorLicenseFolder(
		)
	{
		/* method MonitorLicenseFolder */
	}
	/* DISPID=29 */
	function ShutdownLicenseFolderMonitor(
		)
	{
		/* method ShutdownLicenseFolderMonitor */
	}
	/* DISPID=30 */
	/* VT_BSTR [8] */
	function GetFolderPath(
		/* VT_UI4 [19] [in] */ $__MIDL_0037 
		)
	{
		/* method GetFolderPath */
	}
}

binary info:
>lm -vm
    Image path: C:\Program Files\RealArcade\Installer\bin\InstallerDlg.dll
    Image name: InstallerDlg.dll
    Timestamp:        Mon Mar 14 14:22:44 2011 (4D7E6B04)
    CheckSum:         00000000
    ImageSize:        00064000
    File version:     2.6.0.445
    Product version:  2.6.0.445
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    ProductName:      InstallerDlg Module
    InternalName:     InstallerDlg
    OriginalFilename: InstallerDlg.dll
    ProductVersion:   2.6.0.445
    FileVersion:      2.6.0.445
    FileDescription:  InstallerDlg Module
    LegalCopyright:   Copyright 2010

POC:

pocs availiable here: http://retrogod.altervista.org/9sg_realgames_i.html
                      http://www.exploit-db.com/sploits/9sg_StubbyUtil.ShellCtl.1.zip