:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: vielib.dll 2.2.5.42958 VmWare Inc version 6.0.0 Remote Code Execution ===================================================================== Internal ID: VULWAR200707295. ----------- Introduction ------------ vielib.dll is a library included in the Program Vmware Workstation Version 6.0.0 from Vmware Inc. Company. Tested In --------- - Windows XP SP1/SP2 french/english with IE 6.0 / 7.0. Summary ------- The StartProcess, CreateProcess and CreateProcessEx methods don't check if they are being called from the application or from a malicious user. A Remote Attacker could craft a html page and execute code in a remote system with the privileges of the user that is running the affected software. Impact ------ The vulnerability could allow malicious users to remotely execute code on a vulnerable system that uses this software. Workaround ---------- - Activate the Kill bit zero in the clsid corresponding to the software. - Unregister vielib.dll using regsvr32. Timeline -------- July 29 2007 -- Bug Discovery. July 30 2007 -- Exploit published. Credits ------- * callAX * GoodFellas Security Research Team Technical Details ----------------- StartProcess method needs three files (stdin, stdout, stderr) as arguments to successfully start a process. The exploit is using three standard files that exists in every Microsoft Office 2003 Application. Exploit (StartProcess Bug) --------------------------

POC (CreateProcess Bug) -----------------------