Data Dynamics ActiveReports Actrpt2.DLL ActiveX Control Arbitrary File Overwrite Vulnerability
BID:24994
Info
Data Dynamics ActiveReports Actrpt2.DLL ActiveX Control Arbitrary File Overwrite Vulnerability
| Bugtraq ID: | 24994 |
| Class: | Design Error |
| CVE: |
CVE-2007-3982 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 21 2007 12:00AM |
| Updated: | May 07 2015 05:36PM |
| Credit: | shinnai is credited with the discovery of this vulnerability. |
| Vulnerable: |
Data Dynamics ActiveReport ActiveX Control 2.5 |
| Not Vulnerable: | |
Discussion
Data Dynamics ActiveReports Actrpt2.DLL ActiveX Control Arbitrary File Overwrite Vulnerability
Data Dynamics ActiveReports ActiveX control is prone to an arbitrary file-overwrite vulnerability due to a design error.
An attacker can exploit this issue to overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer). Successful exploits will allow attackers to cause denial-of-service conditions; other consequences are possible.
This issue affect Data Dynamics ActiveReports 2.5 and prior versions.
Data Dynamics ActiveReports ActiveX control is prone to an arbitrary file-overwrite vulnerability due to a design error.
An attacker can exploit this issue to overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer). Successful exploits will allow attackers to cause denial-of-service conditions; other consequences are possible.
This issue affect Data Dynamics ActiveReports 2.5 and prior versions.
Exploit / POC
Data Dynamics ActiveReports Actrpt2.DLL ActiveX Control Arbitrary File Overwrite Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web page.
The following exploit is available:
To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web page.
The following exploit is available:
Solution / Fix
Data Dynamics ActiveReports Actrpt2.DLL ActiveX Control Arbitrary File Overwrite Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Data Dynamics ActiveReports Actrpt2.DLL ActiveX Control Arbitrary File Overwrite Vulnerability
References:
References:
- Data Dynamics Web Site (Data Dynamics)