Executive Summary
Summary | |
---|---|
Title | Husdawg, LLC Systems Requirements Lab ActiveX control and Java applet vulnerable to arbitrary code download and execution |
Informations | |||
---|---|---|---|
Name | VU#166651 | First vendor Publication | 2008-10-14 |
Vendor | VU-CERT | Last vendor Modification | 2008-10-20 |
Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Vulnerability Note VU#166651Husdawg, LLC Systems Requirements Lab ActiveX control and Java applet vulnerable to arbitrary code download and executionOverviewThe Husdawg, LLC. System Requirements Lab ActiveX control and Java applet allow an unauthenticated remote attacker to download and execute arbitrary code.I. DescriptionHusdawg, LLC. provides an ActiveX control and signed Java Applet that are used for benchmarking the capabilities of a PC. The ActiveX control is provided by sysreqlab.dll, sysreqlabsli.dll, or sysreqlab2.dll, and the Java version is provided by SRLApplet.class, which may be contained in sysreqlab2.jar or sysreqlab.jar. The software is commonly used to determine if a system meets the requirements necessary to run video games. The System Requirements Lab components can be scripted to request an executable file from that server, which is then immediately executed. This file may be retrieved over HTTP, HTTPS, or FTP protocols.II. ImpactA remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable server.III. SolutionApply an updateThis vulnerability is addressed in version 3 of the System Requirements Lab software. This version is available on the systemrequirementlab.com web server. This version of the ActiveX control restricts which domains can call the methods provided by the control.
PASS IEUser@ SIZE //system.xml RETR //system.xml CWD //system.xml The vulnerable ActiveX controls can be disabled in Internet Explorer by setting the kill bit for the following CLSIDs:
{BE833F39-1E0C-468C-BA70-25AAEE55775E} {BE833F39-1E0C-468C-BA70-25AAEE55775F}
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}] "Compatibility Flags"=dword:00000400 [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{BE833F39-1E0C-468C-BA70-25AAEE55775E}] "Compatibility Flags"=dword:00000400 [HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{BE833F39-1E0C-468C-BA70-25AAEE55775F}] "Compatibility Flags"=dword:00000400 Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this and other ActiveX vulnerabilities. Instructions for disabling ActiveX in the Internet Zone can be found in the "Securing Your Web Browser" document. Disable Java This vulnerability can be mitigated by disabling Java in your web browser. Instructions for disabling Java can be found in the "Securing Your Web Browser" document. Systems Affected
Referenceshttp://www.cert.org/blogs/vuls/2008/06/signed_java_security_worse_tha.html This vulnerability was reported by Andre Protas of eEye Digital Security, who in turn credit Greg Linares. Additional information about vulnerable components was provided by Will Dormann of the CERT/CC. This document was written by Will Dormann.
|
Original Source
Url : http://www.kb.cert.org/vuls/id/166651 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
50124 | Systems Requirements Lab sysreqlab2.jar Unspecified Applet Arbitrary Program ... |
50123 | Systems Requirements Lab sysreqlab.jar Unspecified Applet Arbitrary Program E... |
50122 | Systems Requirements Lab sysreqlab2.dll ActiveX Init Method Arbitrary Program... A code execution flaw exists in Systems Requirements Lab. The sysreqlab2.dll ActiveX control contains an unsafe method that allows code download and execution. With a specially crafted website, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity. |
50121 | Systems Requirements Lab sysreqlabsli.dll ActiveX Init Method Arbitrary Progr... |
50120 | Systems Requirements Lab sysreqlab.dll ActiveX Init Method Arbitrary Program ... |
50119 | Systems Requirements Lab sysreqlab2.cab ActiveX Init Method Arbitrary Program... |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Husdawg System Requirements Lab Control ActiveX clsid access RuleID : 27763 - Revision : 4 - Type : BROWSER-PLUGINS |
2014-01-10 | Husdawg System Requirements Lab Control ActiveX clsid access RuleID : 14631 - Revision : 13 - Type : BROWSER-PLUGINS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2008-10-25 | Name : The remote Windows host has an ActiveX control that could allow arbitrary cod... File : husdawg_srl_activex_code_execution.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2020-05-23 13:17:15 |
|
2014-02-17 12:07:33 |
|
2013-05-11 00:56:53 |
|