Vulnerabilities > CVE-2007-5608 - Code Execution in RETIRED: HP Instant Support 'HPISDataManager.dll' ActiveX Control

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
hp
critical
nessus

Summary

The DownloadFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to force a download of an arbitrary file onto a client machine via a URL in the first argument and a destination filename in the second argument, a different vulnerability than CVE-2008-0952 and CVE-2008-0953.

Vulnerable Configurations

Part Description Count
Application
Hp
1

Nessus

NASL familyWindows
NASL idHPISDATAMANAGER_ACTIVEX_1_0_0_24.NASL
descriptionThe remote host contains several ActiveX controls in HP Instant Support HPISDataManager.dll, a web-based diagnostic tool from Hewlett-Packard. The version of the controls installed on the remote host reportedly are affected by several issues. If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, this method could be used to execute arbitrary code by means of buffer overflows or to execute delete, download, and write to arbitrary files on the affected system, all subject to the user
last seen2020-06-01
modified2020-06-02
plugin id33095
published2008-06-05
reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/33095
titleHP Instant Support HPISDataManager.dll ActiveX Control < 1.0.0.24 Vulnerabilities
code
#
#  (C) Tenable Network Security, Inc.
#



include("compat.inc");

if (description)
{
  script_id(33095);
  script_version("1.18");

  script_cve_id(
    "CVE-2007-5604",
    "CVE-2007-5605",
    "CVE-2007-5606",
    "CVE-2007-5607",
    "CVE-2007-5608",
    "CVE-2007-5610",
    "CVE-2008-0952",
    "CVE-2008-0953"
  );
  script_bugtraq_id(
    29529, 
    29530, 
    29531, 
    29532, 
    29533, 
    29534, 
    29535, 
    29536
  );
  script_xref(name:"Secunia", value:"30516");

  script_name(english:"HP Instant Support HPISDataManager.dll ActiveX Control < 1.0.0.24 Vulnerabilities");
  script_summary(english:"Checks version of HPISDataManager.dll control");
 
 script_set_attribute(attribute:"synopsis", value:
"The remote Windows host has several ActiveX controls that are affected
by multiple vulnerabilities." );
 script_set_attribute(attribute:"description", value:
"The remote host contains several ActiveX controls in HP Instant
Support HPISDataManager.dll, a web-based diagnostic tool from
Hewlett-Packard. 

The version of the controls installed on the remote host reportedly
are affected by several issues.  If an attacker can trick a user on
the affected host into viewing a specially crafted HTML document, 
this method could be used to execute arbitrary code by means of
buffer overflows or to execute delete, download, and write to
arbitrary files on the affected system, all subject to the user's
privileges." );
 script_set_attribute(attribute:"see_also", value:"http://www.csis.dk/dk/forside/CSIS-RI-0003.pdf" );
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Jun/29" );
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Jun/26" );
 script_set_attribute(attribute:"solution", value:
"Upgrade to HP Instant Support version 1.0.0.24 or later." );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_cwe_id(94);
 script_set_attribute(attribute:"plugin_publication_date", value: "2008/06/05");
 script_set_attribute(attribute:"patch_publication_date", value: "2008/06/03");
 script_cvs_date("Date: 2018/11/15 20:50:27");
 script_set_attribute(attribute:"plugin_type", value:"local");
 script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:instant_support");
 script_end_attributes();

 
  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl");
  script_require_keys("SMB/Registry/Enumerated");
  script_require_ports(139, 445);

  exit(0);
}


include("global_settings.inc");
include("smb_func.inc");
include("smb_activex_func.inc");


if (!get_kb_item("SMB/Registry/Enumerated")) exit(0);


# Locate the file used by the controls.
if (activex_init() != ACX_OK) exit(0);

clsid = "{14C1B87C-3342-445F-9B5E-365FF330A3AC}";
file = activex_get_filename(clsid:clsid);
if (file)
{
  ver = activex_get_fileversion(clsid:clsid);
  if (ver && activex_check_fileversion(clsid:clsid, fix:"6.0.10.50") == TRUE)
  {
    report = NULL;
    if (report_paranoia > 1)
      report = string(
        "\n",
        "Version ", ver, " of the vulnerable control is installed as :\n",
        "\n",
        "  ", file, "\n",
        "\n",
        "Note, though, that Nessus did not check whether the kill bit was\n",
        "set for the control's CLSID because of the Report Paranoia setting\n",
        "in effect when this scan was run.\n"
      );
    else if (activex_get_killbit(clsid:clsid) == 0)
      report = string(
        "\n",
        "Version ", ver, " of the vulnerable control is installed as :\n",
        "\n",
        "  ", file, "\n",
        "\n",
        "Moreover, its kill bit is not set so it is accessible via Internet\n",
        "Explorer.\n"
      );
    if (report)
    {
      if (report_verbosity) security_hole(port:kb_smb_transport(), extra:report);
      else security_hole(kb_smb_transport());
    }
  }
}
activex_end();

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 29530 CVE(CAN) ID: CVE-2007-5608 HP Instant Support是是基于网络的故障诊断和排除工具套件,适用于桌面计算和打印产品。 HP Instant Support所安装的HPISDataManager.dll ActiveX控件没有正确地过滤对DownloadFile函数的输入参数。如果用户受骗访问了恶意网页并向该函数传送了超长参数的话,就可能导致向本地系统下载任意文件。 HP Instant Support 1.0.0.22 临时解决方法: * 为clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC设置kill-bit。 厂商补丁: HP -- HP已经为此发布了一个安全公告(HPSBMA02326)以及相应补丁: HPSBMA02326:SSRT071490 rev.1 - HP Instant Support HPISDataManager.dll Running on Windows, Remote Execution of Arbitrary Code 链接:<a href=http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01422264 target=_blank>http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01422264</a>
idSSV:3392
last seen2017-11-19
modified2008-06-06
published2008-06-06
reporterRoot
titleHP Instant Support HPISDataManager.dll ActiveX控件任意文件下载漏洞