Nonnoi ASP/Barcode COM Component NONNOI_ASPBarcode.DLL Arbitrary File Overwrite Vulnerability

Bugtraq ID:	24822
Class:	Input Validation Error
CVE:	CVE-2007-3660
Remote:	Yes
Local:	No
Published:	Jul 09 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Michal Bucko is credited with the discovery of this vulnerability.
Vulnerable:	Nonnoi ASP/Barcode 2.20
Not Vulnerable:

Nonnoi ASP/Barcode COM Component NONNOI_ASPBarcode.DLL Arbitrary File Overwrite Vulnerability

Nonnoi ASP/Barcode ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

This issue affects Nonnoi ASP/Barcode 2.20; other versions may also be affected.

Nonnoi ASP/Barcode COM Component NONNOI_ASPBarcode.DLL Arbitrary File Overwrite Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web page.

Nonnoi ASP/Barcode COM Component NONNOI_ASPBarcode.DLL Arbitrary File Overwrite Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Nonnoi ASP/Barcode COM Component NONNOI_ASPBarcode.DLL Arbitrary File Overwrite Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Vendor Homepage (Nonnoi)
  
• [Eleytt] 7LIPIEC2007 ([email protected])