Macrovision InstallShield Update Service 'isusweb.dll' Remote Buffer Overflow Vulnerability
BID:27013
Info
Macrovision InstallShield Update Service 'isusweb.dll' Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 27013 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6654 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 31 2007 12:00AM |
| Updated: | Aug 25 2008 04:25PM |
| Credit: | Elazar Broad is credited with the discovery of this vulnerability. |
| Vulnerable: |
Macrovision Update Service 5.1.100 47363 |
| Not Vulnerable: | |
Discussion
Macrovision InstallShield Update Service 'isusweb.dll' Remote Buffer Overflow Vulnerability
InstallShield Update Service is prone to a remote buffer-overflow vulnerability because it fails to adequately sanitize user-supplied data.
Successfully exploiting this issue will allow an attacker to execute arbitrary code with the permissions of the user running the application.
This issue affects InstallShield Update Service 5.1.100.47363; other versions may also be affected.
NOTE: Reportedly, this issue differs from those documented in BID 26280 (Macrovision InstallShield Update Service Isusweb.DLL Multiple Remote Code Execution Vulnerabilities).
InstallShield Update Service is prone to a remote buffer-overflow vulnerability because it fails to adequately sanitize user-supplied data.
Successfully exploiting this issue will allow an attacker to execute arbitrary code with the permissions of the user running the application.
This issue affects InstallShield Update Service 5.1.100.47363; other versions may also be affected.
NOTE: Reportedly, this issue differs from those documented in BID 26280 (Macrovision InstallShield Update Service Isusweb.DLL Multiple Remote Code Execution Vulnerabilities).
Exploit / POC
Macrovision InstallShield Update Service 'isusweb.dll' Remote Buffer Overflow Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to visit a malicious HTML page.
UPDATE (August 11, 2008): Symantec has detected active exploit attempts in the wild.
An exploit is available.
An attacker can exploit this issue by enticing an unsuspecting victim to visit a malicious HTML page.
UPDATE (August 11, 2008): Symantec has detected active exploit attempts in the wild.
An exploit is available.
Solution / Fix
Macrovision InstallShield Update Service 'isusweb.dll' Remote Buffer Overflow Vulnerability
Solution:
The vendor has released advisories and updates that address this issue. Please see the references for more information.
Solution:
The vendor has released advisories and updates that address this issue. Please see the references for more information.
References
Macrovision InstallShield Update Service 'isusweb.dll' Remote Buffer Overflow Vulnerability
References:
References:
- [Full-disclosure] Installshield Update Service isusweb.dll Buffer Overflow (Elazar Broad)
- Important FLEXnet Connect Vulnerability Patch (Macrovision)
- Microsoft Support Document 240797 (Microsoft)
- Q113020 INFO: FLEXnet Connect 6.0 Security Patch (Macrovision)
- Q113602 INFO: FLEXnet Connect 6.0 Security Patch (Macrovision)