##
# $Id: ms10_018_ie_tabular_activex.rb 9018 2010-04-05 20:25:56Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Internet Explorer Tabular Data Control ActiveX Memory Corruption',
			'Description'    => %q{
					This module exploits a memory corruption vulnerability in the Internet Explorer
				Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet 
				Explorer are vulnerable.

				By specifying a long value as the "DataURL" parameter to this control, it is possible
				to write a NUL byte outside the bounds of an array. By targeting control flow data
				on the stack, an attacker can execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Anonymous',  # original discovery
					'jduck'       # metasploit version
				],
			'Version'        => '$Revision: 9018