HP Instant Support 'HPISDataManager.dll' 'ExtractCab' ActiveX Control Buffer Overflow Vulnerability
BID:29529
Info
HP Instant Support 'HPISDataManager.dll' 'ExtractCab' ActiveX Control Buffer Overflow Vulnerability
| Bugtraq ID: | 29529 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-5604 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 03 2008 12:00AM |
| Updated: | Jun 03 2008 12:00AM |
| Credit: | Dennis Rand |
| Vulnerable: |
HP Instant Support 1.0 .22 |
| Not Vulnerable: |
HP Instant Support 1.0.0.24 |
Discussion
HP Instant Support 'HPISDataManager.dll' 'ExtractCab' ActiveX Control Buffer Overflow Vulnerability
HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
HP Instant Support 1.0.0.22 and earlier versions are affected.
NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.
HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
HP Instant Support 1.0.0.22 and earlier versions are affected.
NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.
Exploit / POC
HP Instant Support 'HPISDataManager.dll' 'ExtractCab' ActiveX Control Buffer Overflow Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious web document.
The following proof of concept is available:
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious web document.
The following proof of concept is available:
Solution / Fix
HP Instant Support 'HPISDataManager.dll' 'ExtractCab' ActiveX Control Buffer Overflow Vulnerability
Solution:
The vendor has released fixes. Please see the references for more information.
Solution:
The vendor has released fixes. Please see the references for more information.
References
HP Instant Support 'HPISDataManager.dll' 'ExtractCab' ActiveX Control Buffer Overflow Vulnerability
References:
References:
- HP Instant Support Home Page (HP )
- Microsoft Support Document 240797 (Microsoft)
- Advisory - HP Online Support Service ActiveX multiple vulnerabilities (CSIS Security Research and Intelligence)
- Vulnerability Note VU#754403 HP Online Support Services ActiveX ExtractCab() buf (US-CERT)