Exploit-DB #12294
Description: Avtech Software - ActiveX 'avc781viewer.dll' Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2010-04-19
Author: LiquidWorm

Exploit:
Title: AVTECH Software (AVC781Viewer.dll) ActiveX Multiple Remote Vulnerabilities



Vendor: AVTECH Software, Inc.
Product Web Page: http://www.avtech.com


Summary: AVTECH Software, a private corporation founded in 1988, is a computer software and
         hardware manufacturer specializing in providing Windows NT/2K/XP/2K3 products to monitor
         multi-OS computers and network issues throughout a department or an entire enterprise.
         Once issues or events occur, AVTECH Software products use today's most advanced alerting
         technologies to communicate critical and important status information to remote system
         managers and IT professionals via mobile phones, pagers, PDAs, email, the web and more.
         Automatic corrective actions can also be taken to immediately resolve issues, run scripts,
         and shutdown/restart servers or applications.

         AVTECH Software is now the premier worldwide manufacturer of environment monitoring equipment
         specifically designed to monitor today's advanced computer rooms and data centers. Our Room Alert
         and TemPageR products are used to monitor environmental conditions in many of the world's most
         secure data centers and are installed in almost every branch of the US government.


Description: AVTECH Software's AVC781Viewer ActiveX Control suffers from multiple remote vulnerabilities
             such as buffer overflow, integer overflow and denial of service (IE crash). This issue is
             triggered when an attacker convinces a victim user to visit a malicious website.

             Remote attackers may exploit this issue to execute arbitrary machine code in the context of
             the affected application, facilitating the remote compromise of affected computers. Failed
             exploit attempts likely result in browser crashes.


Windbg:
======================================================================================================

(265c.26b4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00fe46f0 ebx=00000000 ecx=baadf00d edx=0000001f esi=baadf00d edi=0013f030
eip=10019003 esp=0013ed2c ebp=0013eef4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** WARNING: Unable to verify checksum for C:\WINDOWS\system32\AVC_AX_724_VIEWER.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for AVC_AX_724_VIEWER.dll - 
AVC_AX_724_VIEWER+0x19003:
10019003 837e3c65        cmp     dword ptr [esi+3Ch],65h ds:0023:baadf049=????????

======================================================================================================


Version Tested: 1.0.9.4

Platform Used: Microsoft Windows XP Professional Service Pack 3 (English)
               Microsoft Internet Explorer 8.0.6001.18702


Vulnerability Discovered By: Gjoko 'LiquidWorm' Krstic - liquidworm gmail com
			     Macedonian Information Security Research And Development Laboratory			     
			     Zero Science Lab - http://www.zeroscience.mk


Date: 18.04.2010


Advisory ID: ZSL-2010-4934
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php



######################################## Internal Details ############################################

Vulnerabity type:

 - Buffer Overflow
 - Integer Overflow
 - Denial Of Service


Vulnerable library: AVC781Viewer

Vulnerable class: CV781Object

Vulnerable members: 

 - SendCommand
 - Login
 - Snapshot
 - _DownloadPBOpen
 - _DownloadPBOpen2
 - _DownloadPBClose
 - _DownloadPBControl


File location: C:\WINDOWS\system32\AVC_AX_724_VIEWER.dll
ProgID: AVC781Viewer.CV781Object
CLSID: 8214B72E-B0CD-466E-A44D-1D54D926038D
Version: 1.0.9.4
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data  
IPersist Safe:  Safe for untrusted: caller,data  
IPStorage Safe:  Safe for untrusted: caller,data


CompanyName		AVTECH
FileDescription		SOFTWARE
FileVersion		1.0.9.4
InternalName		AVC781Viewer.dll
LegalCopyright		AVTECH. All rights reserved.
OriginalFileName	AVC781Viewer.dll
ProductName		SOFTWARE
ProductVersion		1.0.9.4


Exception codes (AVC_AX_724_VIEWER.dll):
======================================================================================================

ACCESS_VIOLATION
Disasm: 10019003 CMP DWORD PTR [ESI+3C],65
=====
ACCESS_VIOLATION
Disasm: 1001906F MOV EAX,[ECX+48]
=====
ACCESS_VIOLATION
Disasm: 10006C23 MOV [EAX],CL
=====
ACCESS_VIOLATION
Disasm: 10007163 MOV [EAX],CL
=====
ACCESS_VIOLATION
Disasm: 10008437 MOV DWORD PTR [EAX+B58],1
=====
ACCESS_VIOLATION
Disasm: 10001DDB MOV ECX,[EAX+31C]
=====
ACCESS_VIOLATION
Disasm: 10001E34 MOV EAX,[EAX+31C]
=====
ACCESS_VIOLATION
Disasm: 10008867 MOV DWORD PTR [EAX+B58],1
=====



Two random exception details:
======================================================================================================
======================================================================================================


Exception Code: ACCESS_VIOLATION
Disasm: 10019003	CMP DWORD PTR [ESI+3C],65	(AVC_AX_724_VIEWER.dll)

Seh Chain:
--------------------------------------------------
1 	10023363 	AVC_AX_724_VIEWER.dll
2 	FC2950 	VBSCRIPT.dll
3 	7C839AC0 	KERNEL32.dll


Called From                   Returns To                    
--------------------------------------------------
AVC_AX_724_VIEWER.10019003    VBSCRIPT.F73E27               
VBSCRIPT.F73E27               VBSCRIPT.F73397               
VBSCRIPT.F73397               VBSCRIPT.F73D88               
VBSCRIPT.F73D88               VBSCRIPT.F7409F               
VBSCRIPT.F7409F               VBSCRIPT.F763EE               
V