{"uuid": "25d43096-5c90-4236-8b0a-7ac45179ca78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2386", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/visiwave_vwr_type.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"mr_me \", \"TecR0c \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in VisiWave's Site Survey Report application.\\n          When processing .VWR files, VisiWaveReport.exe attempts to match a valid pointer based on the 'Type'\\n          property (valid ones include 'Properties', 'TitlePage', 'Details', 'Graph', 'Table', 'Text',\\n          'Image'), but if a match isn't found, the function that's supposed to handle this routine\\n          ends up returning the input as a pointer, and later used in a CALL DWORD PTR [EDX+10]\\n          instruction.  This allows attackers to overwrite it with any arbitrary value, and results code\\n          execution.  A patch is available at visiwave.com; the fix is done by XORing the return value as\\n          null if no match is found, and then it is validated before use.\\n\\n          NOTE: During installation, the application will register two file handles, VWS and VWR, which allows a\\n          victim user to 'double click' the malicious VWR file and execute code.  This module was also built\\n          to bypass ASLR and DEP.\", \"disclosure_date\": \"2011-05-20\", \"fullname\": \"exploit/windows/fileformat/visiwave_vwr_type\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"VisiWave VWR File Parsing Vulnerability\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/fileformat/visiwave_vwr_type.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"windows/fileformat/visiwave_vwr_type\", \"references\": [\"CVE-2011-2386\", \"OSVDB-72464\", \"URL-http://www.visiwave.com/blog/index.php?/archives/4-Version-2.1.9-Released.html\", \"URL-http://www.stratsec.net/Research/Advisories/VisiWave-Site-Survey-Report-Trusted-Pointer-%28SS-20\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Windows XP SP3/Windows 7 SP0\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:33.037948Z"}