CVE-2012-2176
published 2012-05-25CVE-2012-2176: Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to…
PriorityP357critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
31.17%
98.1th percentile
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | lotus_quickr | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x81\xc4\x54\xf2\xff\xff
- →Detect ActiveX instantiation of CLSID {05D96F71-87C6-11D3-9BE4-00902742D6E0} (qp2 UploadControl) in browser traffic, especially when followed by assignment to the Attachment_Times or Import_Times property with an anomalously long string value. ↗
- →Look for heap-spray patterns using the 0x0c0c0c0c address in memory or network payloads, indicative of the IE 6/7 exploitation path for this vulnerability. ↗
- →Detect the stack-adjustment prepend encoder bytes \x81\xc4\x54\xf2\xff\xff (add esp, -3500) in shellcode delivered via browser exploits targeting this CVE. ↗
- →Monitor for loading of msvcr71.dll in browser processes (iexplore.exe) as an ASLR-bypass indicator when qp2.dll is also loaded; this combination is specific to exploitation of this vulnerability. ↗
- →Flag HTML responses containing both the CLSID {05D96F71-87C6-11D3-9BE4-00902742D6E0} and JavaScript assignment to Attachment_Times with a string exceeding normal date-time length (exploit uses 512+ byte overflow buffer appended to a date-time prefix). ↗
- ·The exploit targets only qp2.dll version 8.1.0.1800; other versions may have different offsets or may not be exploitable with this module. ↗
- ·The ROP gadget address 0x7C346B52 (pop esp; ret in msvcr71.dll) is hardcoded and version-specific; it applies only to the msvcr71.dll shipped with the qp2 ActiveX and will not work if a different version of msvcr71.dll is present. ↗
- ·IE 9 on Windows 7 uses a different EIP offset (0x5fe) compared to all other targets (0x5f4), requiring a separate detection threshold for payload length. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Lotus QuickR qp2 - ActiveX Buffer Overflow (Metasploit)
exploitdb·2012-12-31
CVE-2012-2176 IBM Lotus QuickR qp2 - ActiveX Buffer Overflow (Metasploit)
IBM Lotus QuickR qp2 - ActiveX Buffer Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 HttpClients::IE,
:ua_minver => "6.0",
:ua_maxver => "9.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:rank => Rank,
:classid => "{05D96F71-87C6-11D3-9BE4-00902742D6E0}",
:method => "Attachment_Times"
})
def initialize(info={})
super(update_info(info,
'Name' => "IBM Lotus QuickR qp2 ActiveX Buffer Overflow",
'Description' => %q{
This module exploits a buffer overflow vulnerability on the UploadControl
ActiveX. The vu
Metasploit
IBM Lotus QuickR qp2 ActiveX Buffer Overflow
metasploit
IBM Lotus QuickR qp2 ActiveX Buffer Overflow
IBM Lotus QuickR qp2 ActiveX Buffer Overflow
This module exploits a buffer overflow vulnerability on the UploadControl ActiveX. The vulnerability exists in the handling of the "Attachment_Times" property, due to the insecure usage of the _swscanf. The affected ActiveX is provided by the qp2.dll installed with the IBM Lotus Quickr product. This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7, using the qp2.dll 8.1.0.1800. In order to bypass ASLR the no aslr compatible module msvcr71.dll is used. This one is installed with the qp2 ActiveX.
No writeups or analysis indexed.
http://www.ibm.com/support/docview.wss?uid=swg21596191http://www.securityfocus.com/bid/53678http://www.securitytracker.com/id?1027097https://exchange.xforce.ibmcloud.com/vulnerabilities/75322http://www.ibm.com/support/docview.wss?uid=swg21596191http://www.securityfocus.com/bid/53678http://www.securitytracker.com/id?1027097https://exchange.xforce.ibmcloud.com/vulnerabilities/75322
2012-05-25
Published