Recognize-Security

HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow exploit (meta)

Posted by Trancer on Oct 14 2008

Wrote a new Metaspoit exploit module for HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow vulnerability.

This module exploits a stack-based buffer overflow in SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 installed by TestDirector (TD) for Hewlett-Packard Mercury Quality Center 9.0 before Patch 12.1, and 8.2 SP1 before Patch 32. By setting an overly long value to ‘ProgColor’, an attacker can overrun a buffer and execute arbitrary code.

Download hpmqc_progcolor.rb.
Also on Metasploit.

References:
CVE-2007-1819
BID 23239
OSVDB 34317
iDefense Labs
HP Security Bulletin

Categories: Exploits, Metasploit

0 Comments | Comments RSS | TrackBack URL

Recognize-Security Welcome to the Machine October 2008

HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow exploit (meta) Posted by Trancer on Oct 14 2008 Wrote a new Metaspoit exploit module for HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow vulnerability. This module exploits a stack-based buffer overflow in SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 installed by TestDirector (TD) for Hewlett-Packard Mercury Quality Center 9.0 before Patch 12.1, and 8.2 SP1 before Patch 32. By setting an overly long value to ‘ProgColor’, an attacker can overrun a buffer and execute arbitrary code. Download hpmqc_progcolor.rb. Also on Metasploit. References: CVE-2007-1819 BID 23239 OSVDB 34317 iDefense Labs HP Security Bulletin Categories: Exploits, Metasploit 0 Comments \| Comments RSS \| TrackBack URL Leave a Reply Click here to cancel reply. Name (required) Mail (will not be published) (required) Website	Categories Advisories Articles Exploitation Exploits LOLz Malware Metasploit Presentations Rec-Sec Security News Tools Vulnerabilities Web Application Security Archives March 2010 January 2010 December 2009 November 2009 October 2009 September 2009 August 2009 July 2009 June 2009 May 2009 April 2009 March 2009 February 2009 December 2008 November 2008 October 2008 September 2008 August 2008 January 2008 June 2007 May 2007 April 2007 March 2007 February 2007 Pages About Recognize-Security Links BinaryVision BlackHat Security BugSec Ltd. Digital Whisper Extraexploit Inj3ct0r exploit database milw0rm NiX IRC Network NullByte Pankaj Kohli Peter Van Eeckhoutte The Metasploit Project TryThis0ne Udi Mosayev Uninformed xorl eax, eax Meta RSS 2.0 ATOM 1.0 RDF 1.0 Links OPML OpenSearch
Valid XHTML \| Valid CSS \| RSS \| Comments RSS Copyright © 2009 Recognize-Security. Some rights reserved. ~~Security~~ Hacking, However, is an art, not a science.

October 2008

HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow exploit (meta)

Leave a Reply