BID:34789

BaoFeng Storm ActiveX Control 'OnBeforeVideoDownload()' Buffer Overflow Vulnerability

Info

BaoFeng Storm ActiveX Control 'OnBeforeVideoDownload()' Buffer Overflow Vulnerability

Bugtraq ID:	34789
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 30 2009 12:00AM
Updated:	Mar 03 2010 05:41AM
Credit:	MITBOY
Vulnerable:	BaoFeng Storm 3.9.4 .27 BaoFeng Storm 3.9.4 .17 BaoFeng Storm 3.9.3 .30 BaoFeng Storm 3.9.3 .25 BaoFeng Storm 2.7.9 .8 BaoFeng Storm 2.7.9 .10 BaoFeng Storm 2.9 BaoFeng Storm 2.8 BaoFeng Storm 2.8

Not Vulnerable:

Discussion

BaoFeng Storm ActiveX Control 'OnBeforeVideoDownload()' Buffer Overflow Vulnerability

BaoFeng Storm ActiveX control is prone to a buffer-overflow vulnerability because the application fails to adequately check boundaries on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

Exploit / POC

BaoFeng Storm ActiveX Control 'OnBeforeVideoDownload()' Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

UPDATE (May 7, 2009): Symantec has detected active exploits of this issue in the wild.

The following exploits are available:

/data/vulnerabilities/exploits/34789.rb
/data/vulnerabilities/exploits/34789.html

Solution / Fix

BaoFeng Storm ActiveX Control 'OnBeforeVideoDownload()' Buffer Overflow Vulnerability

Solution:
A patch is available. Please see the references for more information.

BaoFeng Storm 2.8