RealNetworks RealGames StubbyUtil.ShellCtl.1 ActiveX Control (InstallerDlg.dll v2.6.0.445) Multiple Remote Commands Execution and Code Execution Vulnerabilitiestested against Internet Explorer 9, Vista sp2download url: http://www.gamehouse.com/background:When choosing to play with theese online games ex. the game called"My Farm Life" (see url: http://www.gamehouse.com/download-games/my-farm-life )you download an installer called GameHouse-Installer_am-myfarmlife_gamehouse_.exeThis setup program installs an ActiveX with the following settings:CLSID: {80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}Progid: StubbyUtil.ShellCtl.1Binary Path: C:/Program Files/RealArcade/Installer/bin/InstallerDlg.dllSafe For Initialization (Registry): TrueSafe For Scripting (Registry): TrueThis control is safe for scripting and safe for initialization,so Internet Explorer will allow scripting of this control fromremote.vulnerability:This control has four methods implemented insecurely:ShellExec()      -> allows to launch arbitrary commandsShellExecRunAs() -> allows to launch arbitrary commandsCreateShortcut() -> allows to create arbitrary executable files inside the automatic                    startup foldersCopyDocument()   -> allows to copy arbitrary executable files from a remote                    network share to local folders, ex. automatic startup foldersother attacks are possible including information disclosure and file deletion, see typelib:class IShellCtl { /* GUID={0D60A064-2009-4623-8FC1-F99CAC01037E} */	/* DISPID=1610612736 */	function QueryInterface(		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,		/* VT_PTR [26] [out] --> VT_PTR [26]  */ &$ppvObj 		)	{	}	/* DISPID=1610612737 */	/* VT_UI4 [19] */	function AddRef(		)	{	}	/* DISPID=1610612738 */	/* VT_UI4 [19] */	function Release(		)	{	}	/* DISPID=1610678272 */	function GetTypeInfoCount(		/* VT_PTR [26] [out] --> VT_UINT [23]  */ &$pctinfo 		)	{	}	/* DISPID=1610678273 */	function GetTypeInfo(		/* VT_UINT [23] [in] */ $itinfo,		/* VT_UI4 [19] [in] */ $lcid,		/* VT_PTR [26] [out] --> VT_PTR [26]  */ &$pptinfo 		)	{	}	/* DISPID=1610678274 */	function GetIDsOfNames(		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,		/* VT_PTR [26] [in] --> VT_PTR [26]  */ &$rgszNames,		/* VT_UINT [23] [in] */ $cNames,		/* VT_UI4 [19] [in] */ $lcid,		/* VT_PTR [26] [out] --> VT_I4 [3]  */ &$rgdispid 		)	{	}	/* DISPID=1610678275 */	function Invoke(		/* VT_I4 [3] [in] */ $dispidMember,		/* VT_PTR [26] [in] --> ? [29]  */ &$riid,		/* VT_UI4 [19] [in] */ $lcid,		/* VT_UI2 [18] [in] */ $wFlags,		/* VT_PTR [26] [in] --> ? [29]  */ &$pdispparams,		/* VT_PTR [26] [out] --> VT_VARIANT [12]  */ &$pvarResult,		/* VT_PTR [26] [out] --> ? [29]  */ &$pexcepinfo,		/* VT_PTR [26] [out] --> VT_UINT [23]  */ &$puArgErr 		)	{	}	/* DISPID=1 */	function CreateShortcut(		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$name,		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$target,		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$icon,		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$workingDir,		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$args 		)	{		/* method CreateShortcut */	}	/* DISPID=2 */	function DeleteShortcut(		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$name 		)	{		/* method DeleteShortcut */	}	/* DISPID=3 */	/* VT_BSTR [8] */	function ModuleFileName(		)	{		/* method ModuleFileName */	}	/* DISPID=4 */	/* VT_BSTR [8] */	function GetSpecialFolder(		/* VT_UI4 [19] [in] */ $__MIDL_0025 		)	{		/* method GetSpecialFolder */	}	/* DISPID=5 */	/* VT_BOOL [11] */	function CheckWnd(		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0026 		)	{		/* method CheckWnd */	}	/* DISPID=6 */	/* VT_BSTR [8] */	function ExistingTPS(		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0028 		)	{		/* method ExistingTPS */	}	/* DISPID=7 */	function SetWorkingDir(		/* VT_PTR [26] [in] --> VT_BSTR [8]  */ &$__MIDL_0030 		)	{		/* method SetWorkingDir */	}	/* DISPID=8 */	/* VT_BSTR [8] */	function GetWorkingDir(		)	{		/* method GetWorkingDir */	}	/* DISPID=9 */	/* VT_R8 [5] */	function OSVersion(		)	{		/* method OSVersion */	}	/* DISPID=10 */	/* VT_BSTR [8] */	function GetSystemID(		)	{		/* method GetSystemID */	}	/* DISPID=11 */	function InstallFromCD(		/* VT_BSTR [8] [in] */ $GameID,		/* VT_BSTR [8] [in] */ $GameName,		/* VT_BSTR [8] [in] */ $Tps,		/* VT_BSTR [8] [in] */ $GameLang,		/* VT_BSTR [8] [in] */ $CDPath,		/* VT_BSTR [8] [in] */ $StoreFront 		)	{		/* method InstallFromCD */	}	/* DISPID=12 */	/* VT_UI4 [19] */	function KillProcess(		/* VT_BSTR [8] [in] */ $__MIDL_0033 		)	{		/* method KillProcess */	}	/* DISPID=13 */	function RefreshAddRemovePrograms(		)	{		/* method RefreshAddRemovePrograms */	}	/* DISPID=14 */	function ShellExec(		/* VT_BSTR [8] [in] */ $FilePath,		/* VT_BSTR [8] [in] */ $Params 		)	{		/* method ShellExec */	}	/* DISPID=15 */	function ShellExecRunAs(		/* VT_BSTR [8] [in] */ $FilePath,		/* VT_BSTR [8] [in] */ $Params 		)	{		/* method ShellExecRunAs */	}	/* DISPID=16 */	/* VT_BSTR [8] */	function PlatformInfo(		)	{		/* method PlatformInfo */	}	/* DISPID=17 */	/* VT_BSTR [8] */	function GetAvailableDrive(		/* VT_INT [22] [in] */ $reqSpace 		)	{		/* method GetAvailableDrive */	}	/* DISPID=18 */	/* VT_BOOL [11] */	function InitializeStamp(		/* VT_BSTR [8] [in] */ $exeName,		/* VT_INT [22] [in] */ $offset 		)	{		/* method InitializeStamp */	}	/* DISPID=19 */	/* VT_BSTR [8] */	function GetContentID(		)	{		/* method GetContentID */	}	/* DISPID=20 */	/* VT_BSTR [8] */	function GetTrackingID(		)	{		/* method GetTrackingID */	}	/* DISPID=21 */	/* VT_BSTR [8] */	function GetAffiliate(		)	{		/* method GetAffiliate */	}	/* DISPID=22 */	/* VT_BSTR [8] */	function GetCurrency(		)	{		/* method GetCurrency */	}	/* DISPID=23 */	/* VT_BSTR [8] */	function GetPrice(		)	{		/* method GetPrice */	}	/* DISPID=24 */	/* VT_BSTR [8] */	function GetTimestamp(		)	{		/* method GetTimestamp */	}	/* DISPID=25 */	/* VT_BSTR [8] */	function GetOTP(		)	{		/* method GetOTP */	}	/* DISPID=26 */	/* VT_BOOL [11] */	function CopyDocument(		/* VT_BSTR [8] [in] */ $src,		/* VT_BSTR [8] [in] */ $dest 		)	{		/* method CopyDocument */	}	/* DISPID=27 */	function InstallerToForeground(		)	{		/* method InstallerToForeground */	}	/* DISPID=28 */	function MonitorLicenseFolder(		)	{		/* method MonitorLicenseFolder */	}	/* DISPID=29 */	function ShutdownLicenseFolderMonitor(		)	{		/* method ShutdownLicenseFolderMonitor */	}	/* DISPID=30 */	/* VT_BSTR [8] */	function GetFolderPath(		/* VT_UI4 [19] [in] */ $__MIDL_0037 		)	{		/* method GetFolderPath */	}}binary info:>lm -vm    Image path: C:/Program Files/RealArcade/Installer/bin/InstallerDlg.dll    Image name: InstallerDlg.dll    Timestamp:        Mon Mar 14 14:22:44 2011 (4D7E6B04)    CheckSum:         00000000    ImageSize:        00064000    File version:     2.6.0.445    Product version:  2.6.0.445    File flags:       0 (Mask 3F)    File OS:          4 Unknown Win32    File type:        2.0 Dll    File date:        00000000.00000000    Translations:     0409.04b0    ProductName:      InstallerDlg Module    InternalName:     InstallerDlg    OriginalFilename: InstallerDlg.dll    ProductVersion:   2.6.0.445    FileVersion:      2.6.0.445    FileDescription:  InstallerDlg Module    LegalCopyright:   Copyright 2010POC:pocs availiable here: http://retrogod.altervista.org/9sg_realgames_i.html                      http://www.exploit-db.com/sploits/9sg_StubbyUtil.ShellCtl.1.zip