CVE-1999-1575
Internet Explorer 4.01/5.0 - Arbitrary File Write and Command Execution via ActiveX Controls
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-1999-1575. PoCs published by Shane Hird.
AI-analyzed exploit summary This exploit leverages a buffer overflow in the setupctl ActiveX control in Microsoft Internet Explorer 4.0. It overwrites the return address with a JMP ESP instruction from SHELL32 and executes arbitrary shellcode to launch CALC.EXE.
Description
The Kodak/Wang (1) Image Edit (imgedit.ocx), (2) Image Annotation (imgedit.ocx), (3) Image Scan (imgscan.ocx), (4) Thumbnail Image (imgthumb.ocx), (5) Image Admin (imgadmin.ocx), (6) HHOpen (hhopen.ocx), (7) Registration Wizard (regwizc.dll), and (8) IE Active Setup (setupctl.dll) ActiveX controls for Internet Explorer (IE) 4.01 and 5.0 are marked as "Safe for Scripting," which allows remote attackers to create and modify files and execute arbitrary commands.
Exploits (3)
This exploit leverages a buffer overflow in the setupctl ActiveX control in Microsoft Internet Explorer 4.0. It overwrites the return address with a JMP ESP instruction from SHELL32 and executes arbitrary shellcode to launch CALC.EXE.
This is a functional proof-of-concept exploit for a buffer overflow vulnerability in the hhopen OLE control (hhopen.ocx) in older versions of Internet Explorer. The exploit uses a long string to overflow the buffer and overwrite the return address, leading to arbitrary code execution.
This is a functional exploit for a buffer overflow vulnerability in the Internet Explorer Registration Wizard control (regwizc.dll). It leverages a long string with a '/i' prefix to overflow the buffer, overwrite the return address, and execute arbitrary commands (e.g., CALC.EXE) via shellcode.