CVE-2012-0267
ntr_activex_control < 1.1.8 - Remote Code Execution via StopModule lModule Parameter
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2012-0267.
PoCs published by Metasploit, Carsten Eiram, juan vazquez, including Metasploit module exploits/windows/browser/ntr_activex_stopmodule.
AI-analyzed exploit summary This Metasploit module exploits a memory dereference vulnerability in the NTR ActiveX Control's StopModule() method, allowing remote code execution via a malicious web page targeting Internet Explorer 6 or 7.
Description
The StopModule method in the NTR ActiveX control before 2.0.4.8 allows remote attackers to execute arbitrary code via a crafted lModule parameter that triggers use of an arbitrary memory address as a function pointer.
Exploits (2)
This Metasploit module exploits a memory dereference vulnerability in the NTR ActiveX Control's StopModule() method, allowing remote code execution via a malicious web page targeting Internet Explorer 6 or 7.
This Metasploit module exploits a memory corruption vulnerability in the NTR ActiveX Control (CVE-2012-0267) by manipulating the `StopModule()` method to dereference a controlled pointer, leading to arbitrary code execution. The exploit uses heap spraying and JavaScript obfuscation to achieve reliability across multiple IE versions.