lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 10 Jan 2011 14:28:59 -0000
From: wsn1983@...il.com
To: bugtraq@...urityfocus.com
Subject: NewvCommon.ocx ActiveX Remote Code Execution Vulnerability

NewvCommon.ocx ActiveX Remote Code Execution Vulnerability
========
Vulnerable:All Version
Vendor:www.newv.com.cn

Details:
========
A remote buffer overflow vulnerability has been found in NewV SmartClient. 
The specific flaw exists within the WriteTextFile method of the Newv ActiveX control (NewvCommon.ocx).
The WriteTextFile method does not handle user's input exactly that a remote attacker can exploit \
this vulnerability to execute arbitrary code.


POC: 
========

Function WriteTextFile (
 	ByVal str  As Variant , 
 	ByVal FilePath  As Variant 
)  As String


0:000> g
(d2c.f84): Unknown exception - code 0eedfade (first chance)
(d2c.f84): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=41414141 edx=7c9232bc esi=00000000 edi=00000000
eip=41414141 esp=0013d8c8 ebp=0013d8e8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
<Unloaded_na.dll>+0x41414140:
41414141 ??              ???


Timeline:
========
2010.10.23   Report to vendor,no response.
2011.01.10   Public



Reference:
========
http://www.newv.com.cn
http://demo.newv.com.cn/lds/module/smartclientsetting.exe
http://www.nansec.com

Powered by blists - more mailing lists