CVE-2012-2175
published 2012-06-20CVE-2012-2175: Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to…
PriorityP259critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
29.44%
98.0th percentile
Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long argument.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
| ibm | lotus_inotes | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x81\xc4\x54\xf2\xff\xff
- →Monitor for instantiation of ActiveX control with CLSID {0F2AAAE3-7E9E-4b64-AB5D-1CA24C6ACB9C} (IBM Lotus iNotes UploadControl) in Internet Explorer, particularly when the Attachment_Times property is set with an unusually long value. ↗
- →Detect heap spray patterns targeting address 0x0c0c0c0c in browser processes, which is the ROP/shellcode landing address used by this exploit. ↗
- →Look for ROP gadgets sourced from dwabho.dll (a non-ASLR module) at address 0x1000f765 (POP EAX # RETN) used to bypass ASLR on Vista and Windows 7 targets. ↗
- →Detect the stack adjustment prepend encoder bytes (\x81\xc4\x54\xf2\xff\xff — 'add esp, -3500') in memory or network payloads as a shellcode preamble indicator for this exploit. ↗
- →The exploit targets IE 6 through IE 9 on Windows XP, Vista, and 7. Alert on dwa85W.dll loaded in iexplore.exe processes on these OS/browser combinations. ↗
- ·JavaScript obfuscation is an optional module feature (OBFUSCATE flag); signature-based detections relying on plain-text JS patterns may be evaded when obfuscation is enabled. ↗
- ·The ROP chain differs per target: msvcrt.dll is used on XP/IE8, while dwabho.dll gadgets are used on Vista/Win7. Detection rules must account for both ROP chain variants. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Lotus iNotes dwa85W - ActiveX Buffer Overflow (Metasploit)
exploitdb·2012-12-31
CVE-2012-2175 IBM Lotus iNotes dwa85W - ActiveX Buffer Overflow (Metasploit)
IBM Lotus iNotes dwa85W - ActiveX Buffer Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 HttpClients::IE,
:ua_minver => "6.0",
:ua_maxver => "9.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:rank => Rank,
:classid => "{0F2AAAE3-7E9E-4b64-AB5D-1CA24C6ACB9C}",
:method => "Attachment_Times"
})
def initialize(info={})
super(update_info(info,
'Name' => "IBM Lotus iNotes dwa85W ActiveX Buffer Overflow",
'Description' => %q{
This module exploits a buffer overflow vulnerability on the UploadControl
ActiveX.
Metasploit
IBM Lotus iNotes dwa85W ActiveX Buffer Overflow
metasploit
IBM Lotus iNotes dwa85W ActiveX Buffer Overflow
IBM Lotus iNotes dwa85W ActiveX Buffer Overflow
This module exploits a buffer overflow vulnerability on the UploadControl ActiveX. The vulnerability exists in the handling of the "Attachment_Times" property, due to the insecure usage of the _swscanf. The affected ActiveX is provided by the dwa85W.dll installed with the IBM Lotus iNotes ActiveX installer. This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7, using the dwa85W.dll 85.3.3.0 as installed with Lotus Domino 8.5.3. In order to bypass ASLR the no aslr compatible module dwabho.dll is used. This one is installed with the iNotes ActiveX.
No writeups or analysis indexed.
2012-06-20
Published