Anzio Web Print Object ActiveX Control Remote Buffer Overflow Vulnerability
BID:30545
Info
Anzio Web Print Object ActiveX Control Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 30545 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-3480 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 20 2008 12:00AM |
| Updated: | Aug 29 2008 10:24PM |
| Credit: | Francisco Falcon of Core Security Technologies |
| Vulnerable: |
Anzio Web Print Object Server Edition 3.2.24 Anzio Web Print Object Personal Edition 3.2.19 Anzio Web Print Object 3.2.24 Anzio Web Print Object 3.2.19 |
| Not Vulnerable: |
Anzio Web Print Object 3.2.30 |
Discussion
Anzio Web Print Object ActiveX Control Remote Buffer Overflow Vulnerability
Anzio Web Print Object ActiveX control is prone to a heap-based buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
The following applications are affected:
Anzio Web Print Object 3.2.19
Anzio Web Print Object 3.2.24
Anzio Print Wizard Server Edition 3.2.19
Anzio Print Wizard Personal Edition 3.2.19
Anzio Web Print Object ActiveX control is prone to a heap-based buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
The following applications are affected:
Anzio Web Print Object 3.2.19
Anzio Web Print Object 3.2.24
Anzio Print Wizard Server Edition 3.2.19
Anzio Print Wizard Personal Edition 3.2.19
Exploit / POC
Anzio Web Print Object ActiveX Control Remote Buffer Overflow Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof of concept is available:
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof of concept is available:
Solution / Fix
Anzio Web Print Object ActiveX Control Remote Buffer Overflow Vulnerability
Solution:
The vendor has released an update. Please see the references for more information.
Anzio Web Print Object 3.2.19
Anzio Web Print Object Personal Edition 3.2.19
Anzio Web Print Object 3.2.24
Anzio Web Print Object Server Edition 3.2.24
Solution:
The vendor has released an update. Please see the references for more information.
Anzio Web Print Object 3.2.19
-
Anzio PWButtonXControl1.ocx
http://www.anzio.com/controls30/PWButtonXControl1.ocx
Anzio Web Print Object Personal Edition 3.2.19
-
Anzio PWButtonXControl1.ocx
http://www.anzio.com/controls30/PWButtonXControl1.ocx
Anzio Web Print Object 3.2.24
-
Anzio PWButtonXControl1.ocx
http://www.anzio.com/controls30/PWButtonXControl1.ocx
Anzio Web Print Object Server Edition 3.2.24
-
Anzio PWButtonXControl1.ocx
http://www.anzio.com/controls30/PWButtonXControl1.ocx
References
Anzio Web Print Object ActiveX Control Remote Buffer Overflow Vulnerability
References:
References:
- Microsoft Knowledge Base Article 240797 (Microsoft)
- Vendor Homepage (Anzio)
- Anzio Web Print Object Buffer Overflow (Core Security Technologies)