InstallShield Update Service Agent ActiveX Control Buffer Overflow Vulnerability
BID:31235
Info
InstallShield Update Service Agent ActiveX Control Buffer Overflow Vulnerability
| Bugtraq ID: | 31235 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-2470 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 18 2008 12:00AM |
| Updated: | Sep 18 2008 08:40PM |
| Credit: | Brian Dowling of Simplicity Communications |
| Vulnerable: |
InstallShield Software Corporation InstallShield Update Service 0 |
| Not Vulnerable: | |
Discussion
InstallShield Update Service Agent ActiveX Control Buffer Overflow Vulnerability
InstallShield Update Service Agent ActiveX Control is prone to a buffer-overflow vulnerability because the application fails to adequately check boundaries on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
InstallShield Update Service Agent ActiveX Control is prone to a buffer-overflow vulnerability because the application fails to adequately check boundaries on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
Exploit / POC
InstallShield Update Service Agent ActiveX Control Buffer Overflow Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.
Solution / Fix
InstallShield Update Service Agent ActiveX Control Buffer Overflow Vulnerability
Solution:
The vendor has addressed this issue in FLEXnet Connect 6.0 Security Patch. Contact the vendor for details on obtaining the appropriate updates.
Solution:
The vendor has addressed this issue in FLEXnet Connect 6.0 Security Patch. Contact the vendor for details on obtaining the appropriate updates.
References
InstallShield Update Service Agent ActiveX Control Buffer Overflow Vulnerability
References:
References:
- FLEXnet Connect 6.0 Security Patch (macrovision)
- FLEXnet Connect Homepage (Acresso Software)
- InstallShield Update Service Homepage (Acresso Software)
- Microsoft Knowledge Base Article 240797 (Microsoft)
- Vulnerability Note VU#630017 InstallShield Update Service Agent ActiveX control (US-CERT)