module

Oracle AutoVue ActiveX Control SetMarkupMode Buffer Overflow

Try Surface Command
Back to search
Disclosed
2012-04-18
Created
2018-05-30

Description

This module exploits a vulnerability found in the AutoVue.ocx ActiveX control.
The vulnerability, due to the insecure usage of an strcpy like function in the
SetMarkupMode method, when handling a specially crafted sMarkup argument, allows
to trigger a stack based buffer overflow which leads to code execution under the
context of the user visiting a malicious web page.

The module has been successfully tested against Oracle AutoVue Desktop Version
20.0.0 (AutoVue.ocx 20.0.0.7330) on IE 6, 7, 8 and 9 (Java 6 needed to DEP and
ASLR bypass).

Authors

Brian Gorenc
juan vazquez juan.vazquez@metasploit.com

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/browser/oracle_autovue_setmarkupmode
    msf exploit(oracle_autovue_setmarkupmode) > show targets
        ...targets...
    msf exploit(oracle_autovue_setmarkupmode) > set TARGET < target-id >
    msf exploit(oracle_autovue_setmarkupmode) > show options
        ...show and set options...
    msf exploit(oracle_autovue_setmarkupmode) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today