Chilkat ASP String ActiveX Control CKString.DLL Arbitrary File Overwrite Vulnerability

Bugtraq ID:	25205
Class:	Input Validation Error
CVE:	CVE-2007-4252
Remote:	Yes
Local:	No
Published:	Aug 06 2007 12:00AM
Updated:	May 07 2015 05:36PM
Credit:	shinnai is credited with the discovery of this vulnerability.
Vulnerable:	Chilkat ASP String 1.1
Not Vulnerable:

Chilkat ASP String ActiveX Control CKString.DLL Arbitrary File Overwrite Vulnerability

Chilkat ASP String ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

Chilkat ASP String 1.1 is vulnerable; other versions may also be affected.

Chilkat ASP String ActiveX Control CKString.DLL Arbitrary File Overwrite Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious web page.

The following exploit is available:

• /data/vulnerabilities/exploits/25205

Chilkat ASP String ActiveX Control CKString.DLL Arbitrary File Overwrite Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Chilkat ASP String ActiveX Control CKString.DLL Arbitrary File Overwrite Vulnerability

References:

• Chilkat Software Homepage (Chilkat Software)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)