AOH :: HP Unsorted A :: TB11443.HTM

Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write



Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write
Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write




--=-WBASKuHCak66XcgrndLK
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .: 

Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data
Write
===========================================================================
Internal ID: VULWAR200706264

Introduction
------------
Avaxswf.dll is a library included in the Avax Vector ActiveX v.1.3
software package from the Company Civitech. 
( http://business.hol.gr/gardos/index.htm ) 
Such package include ActiveX control (OCX) that includes over 500
properties, methods, and events to provide full control over vector
drawings. One of the Avaxswf.dll exported methods is vulnerable to Data
write arbitrary in a remote computer.


Tested In
---------
- Windows XP SP2 english/french with IE 6.0 / 7.0.
- windows vista Professional SP1 with IE 7.0.


Summary
-------
The WriteMovie method doesn't check if it is being called from the
application or from a malicious user.


Impact
------
The vulnerability is due to an error in WriteMovie method that
manipulate local files insecurely, which could allow malicious users to
write arbitrary data to any file on a vulnerable system.


Workaround
----------
- Activate the Kill bit zero in
clsid:0DD77391-686B-11D4-B367-D4475FDFF33A.
- Unregister Avaxswf.dll using regsvr32.


Timeline
--------
June 26, 2007 -- Bug discovery.
June 26, 2007 -- Bug published.


Credits
-------
* callAX  
 * GoodFellas Security Research Team 



Technical Detail
----------------
WriteMovie method receives one argument filename in this format 
"c:\path\file".

POC
---








-- 
GOODFELLAS (Shellcode Security Research)
http://goodfellas.shellcode.com.ar 

--=-WBASKuHCak66XcgrndLK
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBGgXEme/hId1O1+uERAlboAJ438y0QRLAZKrIYuqtS7SAoBcBcuQCgjZTY
eyclzYA3uhsQLFtAd/We45I=k3Ui
-----END PGP SIGNATURE-----

--=-WBASKuHCak66XcgrndLK--


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.