:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: sasatl.dll 1.5.0.531 Program Checker-Method DebugMsgLog Heap Spraying Exploit ============================================================================= Internal ID: VULWAR200707121. Introduction ------------ sasatl.dll is a library included in the Program Checker Pro software package from the Company Zenturi. http://www.programchecker.com Tested In --------- - Windows XP SP1/SP2 english/french with IE 6.0 / 7.0. - Windows vista Professional English/French SP1 with IE 7.0 Summary ------- The DebugMsgLog method is prone to a stack-based buffer-overflow vulnerability, because it fails to properly check boundaries. Impact ------ An attacker could execute arbitrary code into the remote machine. Workaround ---------- - Activate the Kill bit zero in clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F51. - Unregister sasatl.dll using regsvr32. Timeline -------- July 12 2007 -- Exploit published. Credits ------- * Vulnerability Discovered by Will Dormann CERT/CC. * Exploit by callAX from GoodFellas Security Research Team Technical Details ----------------- .text:100340F3 sub_100340F3 proc near ; DATA XREF: .rdata:100ACA6Co .text:100340F3 ; .rdata:100AFC1Cto .text:100340F3 mov eax, offset sub_1009D47C .text:100340F8 call __EH_prolog .text:100340FD push dword ptr [ebp+0Ch] ; wchar_t * .text:10034100 lea ecx, [ebp+0Ch] .text:10034103 call sub_1005DC32 .text:10034108 push dword ptr [ebp+0Ch] ; char .text:1003410B and dword ptr [ebp-4], 0 .text:1003410F push offset aCnixonconfig_4 ; "\r\n~CNixonConfigMgrEx::DebugMsgLog %s" .text:10034114 push 1 ; int .text:10034116 call sub_10003099 .text:1003411B or dword ptr [ebp-4], 0FFFFFFFFh .text:1003411F add esp, 0Ch .text:10034122 lea ecx, [ebp+0Ch] .text:10034125 call sub_1005DB6B .text:1003412A mov ecx, [ebp-0Ch] .text:1003412D xor eax, eax .text:1003412F mov large fs:0, ecx .text:10034136 leave .text:10034137 retn 8 Proof of Concept ----------------

Will Dormann from CERT/CC is credited with the discovery.


This exploits executes calc.exe

# milw0rm.com [2007-07-12]