what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

mscbo-overflow.txt

mscbo-overflow.txt
Posted Feb 14, 2007
Authored by Brett Moore SA

Microsoft Interactive Training suffers from a buffer overflow vulnerability when accessing files with .cbo extensions.

tags | advisory, overflow
SHA-256 | ea92dd141ee858165b4262471ac6a3e5cdc1e188ccf30be4703e290ce93ca574

mscbo-overflow.txt

Change Mirror Download
========================================================================
= MS Interactive Training .cbo Overflow
=
= MS Bulletin posted:
= http://www.microsoft.com/technet/security/bulletin/MS07-005.mspx
=
= Affected Software:
= Microsoft Windows 2000
= Microsoft Windows XP
= Microsoft Windows Server 2003
=
= Public disclosure on February 14, 2007
========================================================================

== Overview ==

When thinking about buffer overflow vulnerabilities, a file can
sometimes
be as harmful as a packet. Even though past security issues have taught
us that it is unwise to use a string from a file/packet without first
checking its length, this is what happened here.

MS Interactive Training will open a file with a .cbo extension and read
in the Syllabus details.

Through the creation of a corrupt file, with a long Syllabus string it
is
possible to gain control of EIP and execute arbitrary code.

== Exploitation ==

Remote exploitation through Internet Explorer can be obtained through
hosting a malicious .cbo file which will be downloaded and opened
automatically.

== Solutions ==

- Install the vendor supplied patch.

== Credit ==

Discovered and advised to Microsoft May, 2006 by Brett Moore of
Security-Assessment.com

== About Security-Assessment.com ==

Security-Assessment.com is Australasia's leading team of Information
Security consultants specialising in providing high quality Information
Security services to clients throughout the Asia Pacific region. Our
clients include some of the largest globally recognised companies in
areas such as finance, telecommunications, broadcasting, legal and
government. Our aim is to provide the very best independent advice and
a high level of technical expertise while creating long and lasting
professional relationships with our clients.

Security-Assessment.com is committed to security research and
development, and its team continues to identify and responsibly publish
vulnerabilities in public and private software vendor's products.
Members of the Security-Assessment.com R&D team are globally recognised
through their release of whitepapers and presentations related to new
security research.
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close