Zenturi ProgramChecker ActiveX Control Arbitrary File Deletion/Overwrite Vulnerability
BID:24377
Info
Zenturi ProgramChecker ActiveX Control Arbitrary File Deletion/Overwrite Vulnerability
| Bugtraq ID: | 24377 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-3076 |
| Remote: | Yes |
| Local: | No |
| Published: | May 30 2007 12:00AM |
| Updated: | May 07 2015 05:37PM |
| Credit: | shinnai is credited with the discovery of this vulnerability. |
| Vulnerable: |
Zenturi Zenturi ProgramChecker ActiveX Control 0 |
| Not Vulnerable: | |
Discussion
Zenturi ProgramChecker ActiveX Control Arbitrary File Deletion/Overwrite Vulnerability
Zenturi ProgramChecker ActiveX control is prone to a vulnerability that could permit an attacker to delete or overwrite arbitrary files.
The attacker can exploit this issue to delete or overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).
NOTE: This issue was previously discussed in BID 24217 (Zenturi ProgramChecker SASATL.DLL ActiveX Control Multiple Buffer Overflow Vulnerabilities), but has been assigned its own record because it is a different vulnerability.
Zenturi ProgramChecker ActiveX control is prone to a vulnerability that could permit an attacker to delete or overwrite arbitrary files.
The attacker can exploit this issue to delete or overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).
NOTE: This issue was previously discussed in BID 24217 (Zenturi ProgramChecker SASATL.DLL ActiveX Control Multiple Buffer Overflow Vulnerabilities), but has been assigned its own record because it is a different vulnerability.
Exploit / POC
Zenturi ProgramChecker ActiveX Control Arbitrary File Deletion/Overwrite Vulnerability
UPDATE (August 11, 2008): Symantec has detected active exploit attempts in the wild.
The following proof-of-concept exploit is available:
UPDATE (August 11, 2008): Symantec has detected active exploit attempts in the wild.
The following proof-of-concept exploit is available:
Solution / Fix
Zenturi ProgramChecker ActiveX Control Arbitrary File Deletion/Overwrite Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Zenturi ProgramChecker ActiveX Control Arbitrary File Deletion/Overwrite Vulnerability
References:
References: