SignKorea SKCrypAX ActiveX Control Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	23374
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 09 2007 12:00AM
Updated:	Apr 10 2007 12:42AM
Credit:	Sukhee Jung is credited with discovering these issues.
Vulnerable:	SignKorea SKCrypAX 5.4.1.2
Not Vulnerable:

SignKorea SKCrypAX ActiveX Control Multiple Buffer Overflow Vulnerabilities

SignKorea SKCrypAX is prone to multiple remote buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

Exploiting these issues allows remote attackers to execute arbitrary code in the context of applications using the affected ActiveX control and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions.

These issues affect SKCrypAX 5.4.1.2; other versions may also be affected.

SignKorea SKCrypAX ActiveX Control Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

SignKorea SKCrypAX ActiveX Control Multiple Buffer Overflow Vulnerabilities

Solution:
Reports indicate that this issue may have been fixed in the most current version of the affected application. Symantec has not confirmed this.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

SignKorea SKCrypAX ActiveX Control Multiple Buffer Overflow Vulnerabilities

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• SignKorea Homepage (SignKorea)