Back to search

ActiveFax (ActFax) 4.3 Client Importer Buffer Overflow

This module exploits a vulnerability in ActiveFax Server. The vulnerability is a stack based buffer overflow in the "Import Users from File" function, due to the insecure usage of strcpy while parsing the csv formatted file. The module creates a .exp file that must be imported with ActiveFax Server. It must be imported with the default character set 'ECMA-94 / Latin 1 (ISO 8859)'. The module has been tested successfully on ActFax Server 4.32 over Windows XP SP3 and Windows 7 SP1. In the Windows XP case, when ActFax runs as a service, it will execute as SYSTEM.

Free Metasploit Download

Get your copy of the world's leading penetration testing tool

 Download Now

Module Name

exploit/windows/fileformat/actfax_import_users_bof

Authors

  • Craig Freyman
  • Brandon Perry
  • juan vazquez <juan.vazquez [at] metasploit.com>

References

Targets

  • ActFax 4.32 / Windows XP SP3 EN / Windows 7 SP1

Platforms

  • windows

Reliability

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/fileformat/actfax_import_users_bof msf exploit(actfax_import_users_bof) > show targets ...targets... msf exploit(actfax_import_users_bof) > set TARGET <target-id> msf exploit(actfax_import_users_bof) > show options ...show and set options... msf exploit(actfax_import_users_bof) > exploit