Description
The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute
exploit/windows/browser/c6_messenger_downloaderactivex
Exploit-DB 2
- Icona SpA C6 Messenger - DownloaderActiveX Control Arbitrary File Download and Execute (Metasploit) EDB-18449 · remote · Feb 2, 2012 · verified
- C6 Messenger - ActiveX Remote Download and Execute EDB-5732 · remote · Jun 3, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2008-1733 vdb-entry
- 3926 third-party-advisory
- 30512 third-party-advisory
- 29519 vdb-entry
- 20080603 [NSG 03-06-2008] C6 Messenger Installation Url DownloaderActiveX Control Remote Download & Execute Exploit mailing-list
- iconaspa-downloaderactivex-code-execution(42825) vdb-entry
- 5732 exploit