bugtraq - Taltech Tal Bar Code ActiveX Control Memory Corruption Vulnerability(-ies)

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [month] [year] [list]

Date: Sat, 5 May 2007 20:55:15 +0200
From: "sapheal-hack.pl" <sapheal@...k.pl>
To: <bugtraq@...urityfocus.com>
Subject: Taltech Tal Bar Code ActiveX Control Memory Corruption Vulnerability(-ies)

     Taltech Tal Bar Code ActiveX Control Memory Corruption 
Vulnerability(-ies)
     Michal Bucko (sapheal)
     hack.pl

     I. BACKGROUND

 The Bar Code ActiveX Control has all the features necessary to easily add
  professional quality barcodes to any Windows application including Web 
pages,
 database reporting and labeling, product packaging, document tracking, 
postal
 bar coding and special purpose bar code labeling applications.
 It is an extremely easy and powerful tool that will work flawlessly with 
any
 Windows application that supports ActiveX technology including Visual 
Basic,
 C++, Internet Explorer Web pages, Microsoft Word, Excel, Access, etc.

     II. DESCRIPTION

 The vulnerability lies in SaveBarCode function. The vulnerability allows
 arbitrary code execution (in the context of current user) via a web 
browser.
 The debug snippet shows what happened to the default exception handler:

 41414141 Pointer to next SEH record
 41414141 SE Handler

 Return address and default exception handler were overwritten.

 The other interesting vulnerability (but much of a different character,
 though) allows storage of files on the remote machine. The files contain
 bar codes, however, such an issue might be exploited to store thousands of
 files on the remote machine. The sample exploit for the second 
vulnerability
 is very simple and looks the following way (windows script file [wsf]):

 <?XML version='1.0' standalone='yes' ?>
 <package><job id='DoneInVBS' debug='false' error='true'>
 <object classid='clsid:C917E12F-9757-11D2-85DB-F01851C10000' id='target' />
 <script language='vbscript'>

 arg="somefilename"

 target.SaveBarCode arg

 </script></job></package>