PT-2012-2448 · Ntr · Ntr Activex Control

Carsten Eiram · Published 2012-01-15 · Updated 2017-08-29 · CVE-2012-0266

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NTR ActiveX control versions prior to 2.0.4.8

Description The issue allows remote attackers to execute arbitrary code due to multiple stack-based buffer overflows. This can occur through various methods, including a long bstrUrl parameter to the StartModule method, a long bstrParams parameter to the Check method, or a long bstrUrl parameter to the Download or DownloadModule method during the construction of a .ntr pathname or a URL.

Recommendations For versions prior to 2.0.4.8, update to version 2.0.4.8 or later to resolve the issue. As a temporary workaround, consider restricting the length of the bstrUrl and bstrParams parameters to prevent buffer overflows. Additionally, restrict access to the StartModule, Check, Download, and DownloadModule methods to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-0266

Affected Products

Ntr Activex Control

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ntr_activex_check_bof.rb · Exploit
• 🔥 http://exploit-db.com/exploits/21841 · Exploit
• 🔥 https://exploit-db.com/exploits/21841 · Exploit
• http://secunia.com/secunia_research/2012-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0266 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2012-01/0074.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72291 · Note
• http://secunia.com/advisories/45166 · Note
• http://osvdb.org/78252 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72293 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72292 · Note