______________________________________________________________________ -------------------------- NSOADV-2010-008 --------------------------- AnNoText Third-Party ActiveX Control Buffer Overflow ______________________________________________________________________ ______________________________________________________________________ 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11 1111111 1 111 111001 111111111 0 10 1111 0 11 11 111111111 1 1101 10 00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100 10111111 0 01 0 1 1 111110 11 1111111111111 11110000011 0111111110 0110 1110 1 0 11101111111111111011 11100 00 01111 0 10 1110 1 011111 1 111111111111111111111101 01 01110 0 10 111110 110 0 11101111111111111111101111101 111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111 111110110 10 0111110 1 0 0 1111111111111111111111111 110 111 11111 1 1 111 1 10011 101111111111011111111 0 1100 111 10 110 101011110010 11111111111111111111111 11 0011100 11 10 001100 0001 111111111111111111 10 11 11110 11110 00100 00001 10 1 1111 101010001 11111111 11101 0 1011 10000 00100 11100 00001101 0 0110 111011011 0110 10001 101 11110 1011 1 10 101 000001 01 00 1010 1 11001 1 1 101 10 110101011 0 101 11110 110000011 111 ______________________________________________________________________ ______________________________________________________________________ Title: AnNoText Third-Party ActiveX Control Buffer Overflow Severity: Critical Advisory ID: NSOADV-2010-008 Found Date: 18.03.2010 Date Reported: 25.03.2010 Release Date: 11.06.2010 Author: Nikolas Sotiriu Mail: nso-research at sotiriu.de Website: http://sotiriu.de/ Twitter: http://twitter.com/nsoresearch Advisory-URL: http://sotiriu.de/adv/NSOADV-2010-008.txt Vendor: AnNoText (http://www.annotext.de/) Affected Products: ADVOAkte 17 Build 4.8.0.116 Patchlevel 034 Affected Component: KEYHELPLib ActiveX Control V.1.1.2200.0 Remote Exploitable: Yes Local Exploitable: No Patch Status: unknown (No response from vendor) Discovered by: Nikolas Sotiriu Disclosure Policy: http://sotiriu.de/policy.html Thanks to: Thierry Zoller: For the permission to use his Policy Background: =========== AnNoText is a German Company, which makes Software for lawyers. Description: ============ During the installation of the ADVOAkte an ActiveX Control will be installed (keyhelp.ocx), in which multiple functions are vulnerable to a buffer oveflow bugs, which could lead to a remote code execution. Registered Classes: +------------------ Name: KeyPopup Class Vendor: KeyWorks Software Type: ActiveX-Control Version: 1.1.2200.0 GUID: {1E57C6C4-B069-11D3-8D43-00104B138C8C} File: keyhelp.ocx Folder: C:\WINDOWS\system32\ Safe for Script: True Safe for Init: False Name: KeyScript Class Vendor: KeyWorks Software Type: ActiveX-Control Version: 1.1.2200.0 GUID: {45E66957-2932-432A-A156-31503DF0A681} File: keyhelp.ocx Folder: C:\WINDOWS\system32\ Safe for Script: True Safe for Init: False Name: KeyHelp Embedded Window Vendor: KeyWorks Software Type: ActiveX-Control Version: 1.1.2200.0 GUID: {B7ECFD41-BE62-11D2-B9A8-00104B138C8C} File: keyhelp.ocx Folder: C:\WINDOWS\system32\ Safe for Script: True Safe for Init: True Proof of Concept : ================== http://sotiriu.de/software/NSOPOC-2010-008.zip Solution: ========= Disable the vulnerable ActiveX Control by setting the kill bit for the following CLSID: {1E57C6C4-B069-11D3-8D43-00104B138C8C} {45E66957-2932-432A-A156-31503DF0A681} {B7ECFD41-BE62-11D2-B9A8-00104B138C8C} Save the following text as a .REG file and imported to set the kill bit for this controls: +-------------------------------------- Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1E57C6C4-B069-11D3-8D43-00104B138C8C}] "Compatibility Flags"=dword:00000400 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{45E66957-2932-432A-A156-31503DF0A681}] "Compatibility Flags"=dword:00000400 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B7ECFD41-BE62-11D2-B9A8-00104B138C8C}] "Compatibility Flags"=dword:00000400 +-------------------------------------- More information about how to set the kill bit is available in Microsoft Support Document 240797 (http://support.microsoft.com/kb/240797). Disclosure Timeline (YYYY/MM/DD): ================================= 2010.03.18: Vulnerability found. 2010.03.25: Initial contact by support email address. 2010.03.29: Second contact by support, info and vertrieb (sales) email address. Sent the Notification and Disclosure Policy and the release date (2010.04.08). 2010.03.29: Initial Vendor response. 2010.03.30: Sent PoC, Advisory, Disclosure policy and planned disclosure date (2010.04.08) to Vendor 2010.04.08: Ask for a status update, because the planned release date is 2010.04.08. [-] No Response 2010.04.12: Set Release Date to 2010.04.15. 2010.04.08: Ask for a status update, because the planned release date is 2010.04.15. [-] No Response 2010.04.15: Set Release Date to 2010.04.22. 2010.04.16: Vendor informed me that the vulnerability is a third party issue and AnNoText contacted them. 2010.05.20: Asked if AnNoText already got a fixed version of the third party component. [-] No Response 2010.06.08: Informed AnNoText that the final release date is now the 2010.06.10 [-] No Response 2010.06.11: Release of this Advisory on my website