Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add OSVDB-93754: Synactis PDF In-The-Box ConnectToSynactic Stack Buffer ... #1916

Merged
merged 5 commits into from
Jun 7, 2013
Merged

Add OSVDB-93754: Synactis PDF In-The-Box ConnectToSynactic Stack Buffer ... #1916

merged 5 commits into from
Jun 7, 2013

Commits on Jun 7, 2013

  1. Add OSVDB-93754: Synactis PDF In-The-Box ConnectToSynactic Stack Buff… 

    …er Overflow

This module exploits a vulnerability found in Synactis' PDF In-The-Box ActiveX
component, specifically PDF_IN_1.ocx.  When a long string of data is given
to the ConnectToSynactis function, which is meant to be used for the ldCmdLine
argument of a WinExec call, a strcpy routine can end up overwriting a TRegistry
class pointer saved on the stack, and results in arbitrary code execution under the
context of the user.
    @wchen-r7
    wchen-r7 committed Jun 7, 2013
    Configuration menu
    Copy the full SHA
    d3e57ff View commit details
    Browse the repository at this point in the history

  2. Remove whitespace

    @wchen-r7
    wchen-r7 committed Jun 7, 2013
    Configuration menu
    Copy the full SHA
    e559824 View commit details
    Browse the repository at this point in the history

  3. Fix different landings

    @wchen-r7
    wchen-r7 committed Jun 7, 2013
    Configuration menu
    Copy the full SHA
    f3421f2 View commit details
    Browse the repository at this point in the history

  4. Updates description about default browser setting

    @wchen-r7
    wchen-r7 committed Jun 7, 2013
    Configuration menu
    Copy the full SHA
    9c7b446 View commit details
    Browse the repository at this point in the history

  5. Change to AverageRanking 

    Just to play with the firing order for Browser Autopwn, this one
should fire as late as possible.
    @wchen-r7
    wchen-r7 committed Jun 7, 2013
    Configuration menu
    Copy the full SHA
    ea2895a View commit details
    Browse the repository at this point in the history