HP Photo Digital Imaging HPQXML.DLL Arbitrary File Overwrite Vulnerability

Bugtraq ID:	24678
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 27 2007 12:00AM
Updated:	Jun 28 2007 04:48PM
Credit:	GOODFELLAS Security Research TEAM is credited with the discovery of this vulnerability.
Vulnerable:	HP HP Photo Digital Imaging hpqxml.dll 2.0.0.133
Not Vulnerable:

HP Photo Digital Imaging HPQXML.DLL Arbitrary File Overwrite Vulnerability

HP Photo Digital Imaging ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

This issue affects HP Photo Digital Imaging 2.0.0.133; other versions may also be affected.

HP Photo Digital Imaging HPQXML.DLL Arbitrary File Overwrite Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/24678.html

HP Photo Digital Imaging HPQXML.DLL Arbitrary File Overwrite Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

HP Photo Digital Imaging HPQXML.DLL Arbitrary File Overwrite Vulnerability

References:

• [GOODFELLAS - VULN] hpqxml.dll 2.0.0.133 from HP Digital Imaging Arbitary Data W (Goodfellas SRT )
  
• Hewlett-Packard Photo Digital Imaging Software Site (Hewlett-Packard )
  
• Microsoft Knowledge Base Article 240797 (Microsoft)