CVE-2012-5896
Quest InTrust < 10.4.0.853 - Remote Code Execution via Annotation Objects ActiveX Control
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-5896.
PoCs published by Metasploit, rgod, including Metasploit module exploits/windows/browser/intrust_annotatex_add.
AI-analyzed exploit summary This Metasploit module exploits an uninitialized pointer vulnerability in the Quest InTrust Annotation Objects ActiveX component (CVE-2012-5896). It uses heap spraying and ROP chains to achieve remote code execution on Windows systems with IE6/IE7/IE8.
Description
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an "uninitialized pointer."
Exploits (3)
This Metasploit module exploits an uninitialized pointer vulnerability in the Quest InTrust Annotation Objects ActiveX component (CVE-2012-5896). It uses heap spraying and ROP chains to achieve remote code execution on Windows systems with IE6/IE7/IE8.
This exploit targets an uninitialized pointer vulnerability in Quest InTrust 10.4.x's AnnotationX.AnnList.1 ActiveX control (ANNOTATEX.DLL). By invoking the Add() method, an attacker can execute arbitrary code via a controlled pointer, leveraging heap spraying to achieve remote code execution.
This Metasploit module exploits an uninitialized pointer vulnerability in Quest InTrust Annotation Objects ActiveX component (CVE-2012-5896) via heap spray and ROP chain techniques to achieve remote code execution on Windows XP/Vista/7 targets with IE6-8.