NewvCommon.ocx ActiveX Remote Code Execution Vulnerability
========
Vulnerable:All Version
Vendor:www.newv.com.cn

Details:
========
A remote buffer overflow vulnerability has been found in NewV SmartClient. 
The specific flaw exists within the WriteTextFile method of the Newv ActiveX control (NewvCommon.ocx).
The WriteTextFile method does not handle user's input exactly that a remote attacker can exploit \
this vulnerability to execute arbitrary code.


POC: 
========

Function WriteTextFile (
  ByVal str  As Variant , 
  ByVal FilePath  As Variant 
)  As String


0:000> g
(d2c.f84): Unknown exception - code 0eedfade (first chance)
(d2c.f84): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=41414141 edx=7c9232bc esi=00000000 edi=00000000
eip=41414141 esp=0013d8c8 ebp=0013d8e8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
<Unloaded_na.dll>+0x41414140:
41414141 ??              ???


Timeline:
========
2010.10.23   Report to vendor,no response.
2011.01.10   Public



Reference:
========
http://www.newv.com.cn
http://demo.newv.com.cn/lds/module/smartclientsetting.exe
http://www.nansec.com
 


Comments

04/19/2012 23:36

Thank you for sharing your life-changing Story. Beautiful! I will share with Colleen :)

Reply
09/24/2013 05:10

I am interested in this subject matter and would like to explore out some more information as my colleague need information on this topic

Reply
04/15/2013 03:33

ActiveX is a frame work from Microsoft. This is used for content downloading from a network. This was first released on 1993. Many software from Microsoft works based on this; which includes internet explorer, visual studio, windows media player etc.

Reply
06/17/2013 04:23

Thanks to the author for the excellent article, that his unique material is spread only on sites similar to this, where no one had gone before the giant corporations and their advertising departments. Special thanks to the author for relevance and interesting approach to the presentation of information.

Reply
08/06/2013 22:43

They may also be required to know how to configure web servers such as Apache HTTP server or Internet Information services and be a server administrator. Thanks.

Reply

Some internet page may be very anxious i really do most people don't impulse personally, would not energy should you some E.S. document? Plus it did actually i i actually have noticed out and about take advantage of the types of the most writers. Amount our-self switch on the book marking, therefore you make certain you begin to see the impulse, with thanks for just a okay web page.

Reply
10/31/2013 15:52

I really like this post. It is very interesting topic and the author is really clever and broadminded person. I would like to read another post this author with great pleasure.

Reply

Thanks a lot for the informative blog post.

Reply
12/12/2013 09:34

I just got to this amazing site not long ago. I was actually captured with the piece of resources you have got here. Big thumbs up for making such wonderful blog page!

Reply
12/21/2013 11:20

Okay internet page, I may pre warn his or her neighborhood friends, possibly even longer this will aid people find out how to even more deliver your ex arrange as well as the easiest method to reveal to your client. That we continue to enjoyed the girl's harbour on the place or maybe I believe to try the girl's suppliers on the web-based musician.

Reply
01/18/2014 01:33

Your item has some heavy-duty data. That being said, it's still very simple to realise, alluring and shrewd. It takes an excellent composer with large gut feelings to compose content like this. Thank you for distributing this.

Reply
01/21/2014 00:35

I precisely wished to say thanks yet again. I am not sure the things that When i could possibly have done in the absence of these creative concepts revealed by means of people over this industry.

Reply
02/02/2014 22:50

I am really impressed by this excellent stuff on ZBrush which is a digital sculpting and painting program that has revolutionized the industry. I've enjoyed reading the nice post

Reply

Helpful content and quite thought provoking in fact. Merely wanted to drop you a line to express that I think your webpage is a good reference. Undeniably one for my book marks. Carry on the fantastic work. All the best, Aaron

Reply
02/08/2014 17:44

Great post. I was checking continuously this blog and I’m impressed! Extremely useful information specifically the last part I care for such info much. I was looking for this certain info for a very long time. Thank you and good luck.

Reply
02/08/2014 17:44

This is my first time on this site and, I am begining to be optimistic about the upcoming cpne due to the educational information on your website. This is great and\r\n\r\nexciting. I have just sign up for your workshop (Sheri Taylor).\r\n\r\nThank You.Mary.

Reply
02/17/2014 04:19

I precisely wished to say thanks yet again. I am not sure the things that When i could possibly have done in the absence of these creative concepts revealed by means of people over this industry.

Reply
02/27/2014 09:08

I think other site proprietors should take this website as an model, very clean and great user genial style and design, let alone the content. You’re an expert in this topic!

Reply
02/27/2014 09:08

Great article! I loved the insight and advice given. In addition, your article writing style is very fun to read. If you have time please check out my new webpage and let me know what you think.

Reply

The post is a good one. Anyone’s audience is a group of individuals. Nothing can change it.\r\n\r\nNice article written here. I got to know a few more things about the topic

Reply

thank you for the information. this was very helpful I have a heart rate monitor I use now and was considering getting a body bugg. I currently just track my calories burned by the reading on the machines.

Reply

Good site and good articles…\r\nI like the way you write. Your style is very smooth and I enjoy reading your articles. I think I will be back later and look forward to read more useful posts….

Reply

Congratulations for posting such a useful weblog. Your blog is not only informative but also extremely artistic too. There usually are extremely couple of individuals who can write not so easy articles that creatively. Keep up the great work !!

Reply
03/13/2014 00:23

Having been just looking at related blog content with regard to our project research and My partner and i happened to stumble on yours. Many thanks for this helpful material!

Reply
03/13/2014 00:23

you’re really a good webmaster. The site loading speed is incredible. It seems that you are doing any unique trick. Also, The contents are masterpiece. you have done a fantastic job on this topic!

Reply

It’s hard to search out educated folks on this topic, but you sound like you already know what you’re talking about! Thanks\r\n\r\nIt’s best to participate in a contest for the most effective blogs on the web. I’ll suggest this website!

Reply



Leave a Reply