HP Instant Support 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability
BID:29533
Info
HP Instant Support 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability
| Bugtraq ID: | 29533 |
| Class: | Design Error |
| CVE: |
CVE-2008-0953 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 03 2008 12:00AM |
| Updated: | Aug 25 2008 07:25PM |
| Credit: | Dennis Rand |
| Vulnerable: |
HP Instant Support 1.0 .22 |
| Not Vulnerable: |
HP Instant Support 1.0.0.24 |
Discussion
HP Instant Support 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability
HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to an insecure-method vulnerability.
Successfully exploiting this issue allows remote attackers to launch arbitrary applications with the privileges of the application running the ActiveX control (typically Internet Explorer).
Note that if the attacker could place a malicious executable on the system, they would be able to launch it using this vulnerability.
HP Instant Support 1.0.0.22 and earlier versions are affected.
NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.
HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to an insecure-method vulnerability.
Successfully exploiting this issue allows remote attackers to launch arbitrary applications with the privileges of the application running the ActiveX control (typically Internet Explorer).
Note that if the attacker could place a malicious executable on the system, they would be able to launch it using this vulnerability.
HP Instant Support 1.0.0.22 and earlier versions are affected.
NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.
Exploit / POC
HP Instant Support 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious web document.
The following proof of concept is available:
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious web document.
The following proof of concept is available:
Solution / Fix
HP Instant Support 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability
Solution:
The vendor has released fixes. Please see the references for more information.
Solution:
The vendor has released fixes. Please see the references for more information.
References
HP Instant Support 'HPISDataManager.dll' 'StartApp' ActiveX Control Insecure Method Vulnerability
References:
References:
- HP Instant Support Home Page (HP )
- Microsoft Security Advisory (953839) Cumulative Security Update of ActiveX Kill (Microsoft)
- Microsoft Support Document 240797 (Microsoft)
- Advisory - HP Online Support Service ActiveX multiple vulnerabilities (CSIS Security Research and Intelligence)
- VU#998779 HP Online Support Service ActiveX StartApp() arbitrary code execution (US-CERT)