Microsoft Excel 2003 11.8335.8333 – Use-After-Free

• Exploit Database
• 112 阅读

• 作者： Luigi Auriemma
  日期： 2011-11-04
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18078/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111

  #######################################################################   Luigi Auriemma   Application:Microsoft Excel http://office.microsoft.com/en-us/excel/ http://office.microsoft.com/en-us/downloads/CD001022531.aspx Versions: tested Office 2003 11.8335.8333 SP3 Platforms:Windows Bug:use after free Exploitation: file Date: 03 Nov 2011 (found 24 Aug 2011) Author: Luigi Auriemma e-mail: aluigi@autistici.org web:aluigi.org     #######################################################################     1) Introduction 2) Bug 3) The Code 4) Fix     #######################################################################   =============== 1) Introduction ===============     Excel 2003 is a spreadsheet program, part of the Office 2003 suite still supported by Microsoft.     #######################################################################   ====== 2) Bug ======     Use-after-free probably located in the code that handles the vbscript macros:   eax=00492d78 ebx=00000000 ecx=feeefeee edx=00185ff8 esi=004c72b8 edi=00492478 eip=65058591 esp=00185fd0 ebp=0018601c iopl=0 nv up ei pl nz na pe nc cs=0023ss=002bds=002bes=002bfs=0053gs=002b efl=00210206 VBE6!DllVbeInit+0x40f6f: 65058591 ff11calldword ptr [ecx]ds:002b:feeefeee=???????? 0:000:x86> k ChildEBP RetAddr 0018601c 6501c0dd VBE6!DllVbeInit+0x40f6f 00186074 6505dee2 VBE6!DllVbeInit+0x4abb 001860a8 6505e21c VBE6!DllVbeInit+0x468c0 00186220 767cbc9c VBE6!DllVbeInit+0x46bfa 00000000 00000000 ole32!StgIsStorageFile+0x764   How to replicate: - open the proof-of-concept via web or manually - "An error occurred while loading 'Module1'. Do you want to continue loading the project?" select No, if you select Yes then the bug doesn't seem to be replicable - "Unexpected error (32790)" select OK - "Excel found unreadable content in ..." Yes or No is the same - now reopen the proof-of-concept and the bug will happen immediately   The reopening of the same file seems necessary probably because the Office suite uses only one instance of its programs and performs a particular reallocation of the resources when a file gets reopened.   Note that I have tested only the latest version of Office 2003 on Windows 7.   The proof-of-concept is NOT optimized.   Modified bytes: excel_1a.xls: 0006FCA4 AA 01   excel_1b.xls: 0006FCB0 AD 40     #######################################################################   =========== 3) The Code ===========     http://aluigi.org/poc/excel_1.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18078.zip     #######################################################################   ====== 4) Fix ======     No fix.     #######################################################################