British Telecommunications Consumer Webhelper Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	24219
Class:	Boundary Condition Error
CVE:	CVE-2007-2983
Remote:	Yes
Local:	No
Published:	May 29 2007 12:00AM
Updated:	Oct 26 2007 07:46PM
Credit:	Will Dormann is credited with the discovery of these issues.
Vulnerable:	British Telecommunications Consumer webhelper 2.0.0.7
Not Vulnerable:	British Telecommunications Consumer webhelper 2.0.0.8

British Telecommunications Consumer Webhelper Multiple Buffer Overflow Vulnerabilities

The British Telecommunications Consumer Webhelper ActiveX control is prone to multiple buffer-overflow vulnerabilities because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Versions of British Telecommunications Consumer Webhelper ActiveX Control prior to 2.0.0.8 are vulnerable to these issues.

British Telecommunications Consumer Webhelper Multiple Buffer Overflow Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting user to access a malicious webpage.

The following proof-of-concept example is available:

• /data/vulnerabilities/exploits/24219.html

British Telecommunications Consumer Webhelper Multiple Buffer Overflow Vulnerabilities

Solution:
The vendor has released British Telecommunications Consumer Webhelper 2.0.0.8 to address these issues; please see the references for details.

British Telecommunications Consumer Webhelper Multiple Buffer Overflow Vulnerabilities

References:

• British Telecommunications Web Site (British Telecommunications)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)