HP Photo Digital Imaging HPQVWOCX.DLL Arbitrary File Overwrite Vulnerability

Bugtraq ID:	24793
Class:	Input Validation Error
CVE:	CVE-2007-3649
Remote:	Yes
Local:	No
Published:	Jul 06 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	shinnai is credited with the discovery of this vulnerability.
Vulnerable:	HP HP Photo Digital Imaging hpqvwocx.dll 2.1 .556
Not Vulnerable:

HP Photo Digital Imaging HPQVWOCX.DLL Arbitrary File Overwrite Vulnerability

HP Photo Digital Imaging ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

This issue affects HP Photo Digital Imaging 2.1.0.556; other versions may also be affected.

HP Photo Digital Imaging HPQVWOCX.DLL Arbitrary File Overwrite Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web page.

The following exploit is available:

• /data/vulnerabilities/exploits/24793.html

HP Photo Digital Imaging HPQVWOCX.DLL Arbitrary File Overwrite Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP Photo Digital Imaging HPQVWOCX.DLL Arbitrary File Overwrite Vulnerability

References:

• Hewlett-Packard Photo Digital Imaging Software Site (Hewlett-Packard )
  
• Microsoft Knowledge Base Article 240797 (Microsoft)