CVE-2009-0323
W3C Amaya < 11.0 - Remote Code Execution via Long Input Tag Type Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2009-0323.
PoCs published by Metasploit, Core Security, dookie, original exploit by Rob Carter, including Metasploit module exploits/windows/browser/amaya_bdo.
AI-analyzed exploit summary This exploit targets a stack buffer overflow in Amaya Browser v11 via an overly long string in the 'bdo' tag, allowing arbitrary code execution. It uses a crafted HTTP response with shellcode to trigger the vulnerability.
Description
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an "HTML GI" in a start tag, which is not properly handled by the ProcessStartGI function; and unspecified vectors in (3) html2thot.c and (4) xml2thot.c, related to the msgBuffer variable. NOTE: these are different vectors than CVE-2008-6005.
Exploits (3)
This exploit targets a stack buffer overflow in Amaya Browser v11 via an overly long string in the 'bdo' tag, allowing arbitrary code execution. It uses a crafted HTTP response with shellcode to trigger the vulnerability.
The advisory describes multiple stack-based buffer overflow vulnerabilities in Amaya web editor versions 11.0 and earlier, exploitable via crafted HTML/XML input. The PoC demonstrates a buffer overflow in the 'type' parameter of an 'input' tag, leading to potential arbitrary code execution.
This Metasploit module exploits a stack buffer overflow in Amaya Browser v11.0 via an overly long string in the 'bdo' tag, allowing arbitrary code execution. The exploit uses SEH overwrites and a crafted payload to achieve RCE.