|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 7041 CVE : CVE-2010-0679 CWE : CWE-119 SecurityRisk : High  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : Yes Exploit Available : No Credit : Hyleos Published : 26.02.2010
Advisory Content : ChemviewX ActiveX Control Multiple Stack Overflows Versions affected: v1.9.5 +-----------+ |Description| +-----------+ Hyleos ChemviewX is a free ActiveX control used to visualize chemical structures made from MDL or MOL files. The control is commonly used by university students, organic, inorganic chemists, and chemical engineers. The ClassID of the object is {C372350A-1D5A-44DC-A759-767FC553D96C} and the control is marked Safe For Scripting. Two stack overflows were discovered in the ActiveX control, both overflow conditions can be used to gain command execution. +------------+ |Exploitation| +------------+ Both stack overflow conditions relate to a fixed length buffer being used to remove excessive whitespace characters from a supplied filename path. The methods SaveasMolFile and ReadMolFile are both vulnerable to a stack overflow condition which can be reached when supplying more than 400 white-space characters in the filename argument. Both tab and space characters can be used to trigger the overflow condition. The 401-404th byte will result in the overflow of the call stack return address. Both vulnerabilities can be used to gain command execution when combined with a JavaScript heap spray when jumping into a pre-allocated heap. +--------+ |Solution| +--------+ The vendor was contacted multiple times over a two month period without any response. Use of this control is not suggested as it appears to be unmaintained. If you use this ActiveX control consider setting the kill bit for the controlā��s Classid ({C372350A-1D5A-44DCA759- 767FC553D96C}), or uninstalling the control. +------+ |Credit| +------+ Discovered and advised to Hyleos in December 2009 by Paul <dot> Craig - Security-Assessment.com This advisory is also available from our website: http://www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Ac tivex.pdf Security-Assessment.com is a New Zealand based world leader in web application testing, network security and penetration testing. Security-Assessment.com works with organisations across New Zealand, Australia,Asia Pacific, the United States and the United Kingdom. References : http://www.securityfocus.com/bid/38225
http://www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Activex.pdf
http://www.exploit-db.com/exploits/11422
http://secunia.com/advisories/38523
http://packetstormsecurity.org/1002-exploits/hyleoschemview-heap.rb.txt
http://packetstormsecurity.org/1002-advisories/chemviewx-overflow.txt
http:1584//osvdb.org/62276 Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |