CVE-2012-4333
published 2012-08-14CVE-2012-4333: Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in Samsung NET-i…
PriorityP263critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
60.45%
99.0th percentile
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to execute arbitrary code via a long string in the fname parameter. NOTE: some of these details are obtained from third party information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| samsung | net-i_viewer | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect instantiation of the vulnerable ActiveX CLSIDs (3D6F2DBA-F4E5-40A6-8725-E99BC96CC23A or 208650B1-3CA1-4406-926D-45F2DBB9C299) in HTML/script content, particularly combined with a call to BackupToAvi with a long fname parameter. ↗
- →Monitor for heap-spray pattern using 0x0c0c0c0c return address and large unescape() blobs of \x0c bytes in JavaScript delivered via browser, consistent with the Metasploit exploit module targeting IE 6/7 on Windows XP SP3. ↗
- →Alert on network traffic to UDP ports 4505 and 4508 containing oversized or malformed size fields (negative 32-bit values) targeting NiwMasterService and NiwStorageService respectively. ↗
- →Detect presence of CNC_Ctrl.dll (version 1.5.1.1) on Windows hosts as an indicator of the vulnerable Samsung NET-i viewer 1.37 installation. ↗
- →The exploit uses 'migrate -f' as InitialAutoRunScript; post-exploitation process migration activity following iexplore.exe may indicate successful exploitation. ↗
- ·The ConnectDDNS bug (CLSIDs EEDBA32E and 17A7F731) is noted as unreliable to replicate and was not fully researched; detection confidence for that vector is lower. ↗
- ·Payload bad characters are restricted to null bytes only; any detection based on shellcode patterns must account for null-free shellcode. ↗
- ·No vendor fix was available at time of disclosure; patching is not an available mitigation. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Samsung NET-i viewer - Multiple ActiveX 'BackupToAvi()' Remote Overflows (Metasploit)
exploitdb·2012-06-08
CVE-2012-4333 Samsung NET-i viewer - Multiple ActiveX 'BackupToAvi()' Remote Overflows (Metasploit)
Samsung NET-i viewer - Multiple ActiveX 'BackupToAvi()' Remote Overflows (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "Samsung NET-i viewer Multiple ActiveX BackupToAvi() Remote Overflow",
'Description' => %q{
This module exploits a vulnerability in the CNC_Ctrl.dll ActiveX installed
with the Samsung NET-i viewer 1.37.
Specifically, when supplying a long string for the fname parameter to the
BackupToAvi method, an integer overflow occurs, which leads to a posterior buffer
overflow due to the use of memcpy with an incorrect s
Exploit-DB
Samsung NET-i ware 1.37 - Multiple Vulnerabilities
exploitdb·2012-04-22
CVE-2012-4335 Samsung NET-i ware 1.37 - Multiple Vulnerabilities
Samsung NET-i ware 1.37 - Multiple Vulnerabilities
---
#######################################################################
Luigi Auriemma
Application: Samsung NET-i ware
http://www.samsungsecurity.com/product/product_view.asp?idx=6447
http://www.samsungsecurity.com/product/product_view.asp?idx=5828
Versions: <= 1.37
Platforms: Windows
Bugs: A] Endless loop in remote services
B] Code execution in ConnectDDNS ActiveX
C] Stack overflow in BackupToAvi ActiveX
Exploitation: remote
Date: 21 Apr 2012
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
1) Introduction
"Recording so
Metasploit
Samsung NET-i Viewer Multiple ActiveX BackupToAvi() Remote Overflow
metasploit
Samsung NET-i Viewer Multiple ActiveX BackupToAvi() Remote Overflow
Samsung NET-i Viewer Multiple ActiveX BackupToAvi() Remote Overflow
This module exploits a vulnerability in the CNC_Ctrl.dll ActiveX control installed with the Samsung NET-i viewer 1.37. Specifically, when supplying a long string for the fname parameter to the BackupToAvi method, an integer overflow occurs, which leads to a posterior buffer overflow due to the use of memcpy with an incorrect size, resulting in remote code execution under the context of the user.
No writeups or analysis indexed.
http://secunia.com/advisories/48966http://www.exploit-db.com/exploits/18765http://www.securityfocus.com/bid/53193https://exchange.xforce.ibmcloud.com/vulnerabilities/75070http://secunia.com/advisories/48966http://www.exploit-db.com/exploits/18765http://www.securityfocus.com/bid/53193https://exchange.xforce.ibmcloud.com/vulnerabilities/75070
2012-08-14
Published