Changeset 1529

Timestamp:

01/16/08 15:35:49 (8 months ago)

Author:

jose

Message:

[phoneyc]
found an exploit for QvodCtrl? at SecFocus?, add.
fix:
- add CLSID for QvodCtrl?
- look for URL and url - XXX case independent handling of methods etc?
- proper length check
- object instantiation can be done with name, not just id

Files:

• phoneyc/trunk/ActiveX.py (modified) (1 diff)
• phoneyc/trunk/honeyclient.py (modified) (1 diff)
• phoneyc/trunk/modules/jscript/QvodCtrl.js (modified) (2 diffs)
• phoneyc/trunk/tests/qvodctl-2.html (added)

phoneyc/trunk/ActiveX.py

@@ -50 +50 @@
-        self.clsid['E9880553-B8A7-4960-A668-95C68BED571E'] = MacrovisionFlexNet()
-        self.clsid['A86934DA-C3D6-4C1C-BD83-CA4F14B362DE'] = PTZCamPanel()
+        self.clsid['F3D0D36F-23F8-4682-A195-74C92B03D4AF'] = QvodCtrl()
-
-        self.clsname = {}

phoneyc/trunk/honeyclient.py

@@ -603 +603 @@
-                    for i, j in attrs:
-                        if i == 'id': obj_id = j
+                        if i == 'name': obj_id = j
-                    obj = self.a.get_obj_by_clsid(v)
-                    if not obj: 

phoneyc/trunk/modules/jscript/QvodCtrl.js

@@ -6 +6 @@
-    p = p.toUpperCase();
-    if (p == 'URL') {
-1024
+800
-            add_alert('Qvod Player QvodCtrl Class ActiveX Control overflow in URL property');
-        }
@@ -14 +14 @@
-function QvodCtrl() {
-    this.url = '';
+    this.URL = '';
-    this.watch('url', check_property_attr);
+    this.watch('URL', check_property_attr);
-}