MS Interactive Training .cbo Overflow

[Brett Moore]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
=3D MS Interactive Training .cbo Overflow
=3D
=3D MS Bulletin posted:=20
=3D http://www.microsoft.com/technet/security/bulletin/MS07-005.mspx
=3D
=3D Affected Software:
=3D Microsoft Windows 2000
=3D Microsoft Windows XP =20
=3D Microsoft Windows Server 2003
=3D
=3D Public disclosure on February 14, 2007
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D

=3D=3D Overview =3D=3D

When thinking about buffer overflow vulnerabilities, a file can
sometimes
be as harmful as a packet. Even though past security issues have taught
us that it is unwise to use a string from a file/packet without first
checking its length, this is what happened here.

MS Interactive Training will open a file with a .cbo extension and read=20
in the Syllabus details.

Through the creation of a corrupt file, with a long Syllabus string it
is=20
possible to gain control of EIP and execute arbitrary code.

=3D=3D Exploitation =3D=3D

Remote exploitation through Internet Explorer can be obtained through=20
hosting a malicious .cbo file which will be downloaded and opened=20
automatically.

=3D=3D Solutions =3D=3D

- Install the vendor supplied patch.

=3D=3D Credit =3D=3D

Discovered and advised to Microsoft May, 2006 by Brett Moore of
Security-Assessment.com

=3D=3D About Security-Assessment.com =3D=3D

Security-Assessment.com is Australasia's leading team of Information=20
Security consultants specialising in providing high quality Information=20
Security services to clients throughout the Asia Pacific region. Our=20
clients include some of the largest globally recognised companies in=20
areas such as finance, telecommunications, broadcasting, legal and=20
government. Our aim is to provide the very best independent advice and=20
a high level of technical expertise while creating long and lasting=20
professional relationships with our clients.

Security-Assessment.com is committed to security research and=20
development, and its team continues to identify and responsibly publish=20
vulnerabilities in public and private software vendor's products.=20
Members of the Security-Assessment.com R&D team are globally recognised=20
through their release of whitepapers and presentations related to new=20
security research.