EldoS SecureBlackbox PGPBBox.dll ActiveX Control Arbitrary File Overwrite Vulnerability

Bugtraq ID:	24882
Class:	Input Validation Error
CVE:	CVE-2007-3785
Remote:	Yes
Local:	No
Published:	Jul 12 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	The GOODFELLAS Security Research team and callAX are credited with the discovery of this vulnerability.
Vulnerable:
Not Vulnerable:

EldoS SecureBlackbox PGPBBox.dll ActiveX Control Arbitrary File Overwrite Vulnerability

SecureBlackbox ActiveX control is prone to a vulnerability that could permit an attacker to overwrite arbitrary files.

The attacker can exploit this issue to overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer). This may cause denial-of-service conditions and may also allow the attacker to execute arbitrary code on the victim's computer, which may facilitate a remote compromise.

EldoS SecureBlackbox PGPBBox.dll ActiveX Control Arbitrary File Overwrite Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/24882.html

EldoS SecureBlackbox PGPBBox.dll ActiveX Control Arbitrary File Overwrite Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

EldoS SecureBlackbox PGPBBox.dll ActiveX Control Arbitrary File Overwrite Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• SecureBlackbox Homepage (EldoS)