Blaxxun Contact 3D X-CC3D Browser Object Buffer Overflow Vulnerability

Bugtraq ID:	10064
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 06 2004 12:00AM
Updated:	Apr 06 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to "Rafel Ivgi, The-Insider" <[email protected]>.
Vulnerable:	Blaxxun Contact 3D + Blaxxun Platform 7
Not Vulnerable:

Blaxxun Contact 3D X-CC3D Browser Object Buffer Overflow Vulnerability

The Blaxxun Contact 3D browser object for Internet Explorer is reported to be prone to a buffer overflow vulnerability. The issue is reportedly due to a lack of sufficient boundary checks performed on data assigned to a browser object variable.

It may be possible for an attacker to seize control of the execution flow for the affected browser object, ultimately influencing execution flow into an attacker-supplied payload.

Blaxxun Contact 3D X-CC3D Browser Object Buffer Overflow Vulnerability

A proof of concept that will supposedly trigger a crash of the software has been provided:

• /data/vulnerabilities/exploits/Blaxxun.POC.txt

Blaxxun Contact 3D X-CC3D Browser Object Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Blaxxun Contact 3D X-CC3D Browser Object Buffer Overflow Vulnerability

References:

• Blaxxun 3D Release Notes (Blaxxun)
  
• Blaxxun Platform 7 Homepage (Blaxxun)
  
• blaxxun3D(blaxxun Platform) 7 - Remote Buffer Overflow ("Rafel Ivgi, The-Insider" )