HP Software Update 'Hpufunction.dll' ActiveX Control Insecure Method Vulnerabilities

Bugtraq ID:	28947
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 27 2008 12:00AM
Updated:	Apr 28 2008 07:06PM
Credit:	callAX
Vulnerable:	HP Hpufunction.dll 4.0.0.1
Not Vulnerable:

HP Software Update 'Hpufunction.dll' ActiveX Control Insecure Method Vulnerabilities

HP Software Update ActiveX control is prone to multiple insecure-method vulnerabilities, allowing attackers to launch arbitrary applications from the local system.

An attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious HTML page.

Successfully exploiting these issues allows remote attackers to launch arbitrary applications with the privileges of the application running the ActiveX control (typically Internet Explorer).

Hpufunction.dll 4.0.0.1 is vulnerable; other versions may also be affected.

HP Software Update 'Hpufunction.dll' ActiveX Control Insecure Method Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP Software Update 'Hpufunction.dll' ActiveX Control Insecure Method Vulnerabilities

References:

• Micro News Homepage (phptoys)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)