CVE-2012-2175

Related Files

IBM Lotus iNotes dwa85W ActiveX Buffer Overflow

Posted Dec 31, 2012

Authored by Gaurav Baruah, juan vazquez | Site metasploit.com

This Metasploit module exploits a buffer overflow vulnerability on the UploadControl ActiveX. The vulnerability exists in the handling of the "Attachment_Times" property, due to the insecure usage of the _swscanf. The affected ActiveX is provided by the dwa85W.dll installed with the IBM Lotus iNotes ActiveX installer. This Metasploit module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7, using the dwa85W.dll 85.3.3.0 as installed with Lotus Domino 8.5.3. In order to bypass ASLR the no aslr compatible module dwabho.dll is used. This one is installed with the iNotes ActiveX.

tags | exploit, overflow, activex

systems | windows

advisories | CVE-2012-2175, OSVDB-82755

SHA-256 | a5379e9a43da683cd4806d1f1e1d548d9998b0760444a32f658bcd9210c0c210

Download | Favorite | View

Zero Day Initiative Advisory 12-132

Posted Aug 3, 2012

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-132 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus iNotes. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the dwa85W.cab ActiveX control. When passing a long string argument to the Attachment_Times parameter during the control instantiation it is possible to overflow a stack buffer causing memory corruption. This can be leveraged by an attacker to execute code under the context of the user running the browser.

tags | advisory, remote, overflow, arbitrary, activex

advisories | CVE-2012-2175

SHA-256 | 9ef39f1d18db5bb43468373d5a85085d53296aa6327d16072c4c35ffac79e8ed

Download | Favorite | View