Microsoft ATL/MFC ActiveX Information Disclosure Vulnerability
1 Sep. 2009
Summary
Microsoft's Component Object Model (COM) was designed to allow interoperability between disjointed software components. It is a standardized interface solution to the programming dilemmas involved in object oriented programming, distributed transactions, and inter-language communications. Remote exploitation of an information disclosure vulnerability in Microsoft's ATL/MFC ActiveX template, as included in various vendor's ActiveX controls, allows attackers to read memory contents within Internet Explorer.
One aspect of COM is a process called initialization. This process allows a program to load and store a COM object within various containers, such as OLE compound storage files and raw streams. Depending upon certain characteristics of an OLE component designed with the Microsoft ATL, it is possible to read arbitrary memory inside the Internet Explorer process. By loading a vulnerable ActiveX control and passing in specially crafted persistent storage data, an attacker can cause a string to be read in without being properly NULL terminated. After the object is initialized the attacker may read the data using Java Script. Since the string functions rely on NULL termination to keep track of the end of the string, the attacker may read into the next chunk of memory continuing until two NULL bytes are encountered.
Exploitation of the above vulnerabilities will result in the disclosure of memory contents, potentially including sensitive information. The attack vectors include Internet Explorer, WordPad, Microsoft Office, and any other program that loads arbitrary persistence data and gives the attacker an opportunity to read back the data.
Disclosure Timeline:
12/05/2008 Initial Contact
01/05/2009 Microsoft requested PoC
07/28/2009 Public disclosure via MS09-035 out-of-band bulletin
07/29/2009 Material presented at BlackHat USA
-------------------------------------------------------------------------------------------------------------------------------
Don't just react like a puppet to each malware threat, get ahead of the game: Apply a proactive malware defense.
-
