Re: Macrovision FlexNet Connect DownloadManager Insecure Methods

["Elazar Broad" <elazar () hushmail com>]

Last line got cut off, it should read:

I understand that some of this functionality is by design, however,
there should be some validation in place to verify that the files
that are being downloaded are indeed from a trusted source and are
updates to packages that are actually installed on the system.

On Mon, 14 Jan 2008 14:51:22 -0500 Elazar Broad 
<elazar () hushmail com> wrote:
> Who:
> Macrovision
>
> What:
> Macrovision FlexNext Connect is a software package that allows 
> ISV's to update their software products. It is generally used in 
> conjunction with the InstallShield software deploymnet framework.
>
> FlexNet uses a number of ActiveX controls, some of which are 
> marked 
> safe for scripting, in this case, the DownloadManager object:
>
> ISDM.exe version 6.1.100.61372
> MVSNClientDownloadManager61Lib.DownloadManager
> {FCED4482-7CCB-4E6F-86C9-DCB22B52843C}
> IObjectSafety:
> IO. Safe for scripting (IDispatch)
>
> How:
> This control contains several methods which can be used to 
> silently 
> download arbitrary files to the system and possibly overwrite 
> files 
> in the context of the user.
>
> Workaround:
> Set the killbit for this control and the Basket control(see 
> Notes), 
> see http://support.microsoft.com/kb/240797
>
> Fix:
> None
>
> Exploit;
> http://milw0rm.com/exploits/4909
>
> Notes:
> The Basket object {1DF951B1-8D40-4894-A04C-66AD824A0EEF} of 
> isusweb.dll can be used in a similar manner to download and 
> execute 
> files on a system via the ISDM scheduling framework, however, it 
> does so visibly.
>
> I understand that some of this functionality is by design, 
> however, 
> there should be some validation in place to verify that the files 
> that are being downloaded are indeed from a trusted source and are 
>
>
> --
> Click here and choose from thousands of high quality used cars.
> http://tagline.hushmail.com/fc/Ioyw6h4fKQ1cTGSIM7gFWipCcboNGVFhKad0
> XVtWL17fgTXnXnvcla/
> updates to packages that are actually installed on the system.    
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html

--
Click for free information on accounting careers, $150/hour potential.
http://tagline.hushmail.com/fc/Ioyw6h4dCeTiN9WmX9gVVvVMaDOYyDu09zZgiKuxMS6nANiOH0Hqzu/
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/