GdPicture Pro 'gdpicture4s.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability
BID:31504
Info
GdPicture Pro 'gdpicture4s.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability
| Bugtraq ID: | 31504 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-4453 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 30 2008 12:00AM |
| Updated: | May 07 2015 05:22PM |
| Credit: | EgiX |
| Vulnerable: |
GdPicture GdPicture Pro 0 GdPicture GdPicture Light Imaging Toolkit 4.7.1 |
| Not Vulnerable: |
GdPicture GdPicture Pro Imaging SDK 5.7.2 |
Discussion
GdPicture Pro 'gdpicture4s.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability
An ActiveX control in GdPicture Pro SDK is prone to a vulnerability that lets attackers overwrite files with arbitrary, attacker-controlled content. The issue occurs because the control fails to sanitize user-supplied input.
Successful exploits may compromise affected computers and could aid in further attacks.
This issue affects gdpicture4s.ocx 4.7.0.1. This control is included in GdPicture Light Imaging Toolkit 4.7.1. Other versions may also be affected.
An ActiveX control in GdPicture Pro SDK is prone to a vulnerability that lets attackers overwrite files with arbitrary, attacker-controlled content. The issue occurs because the control fails to sanitize user-supplied input.
Successful exploits may compromise affected computers and could aid in further attacks.
This issue affects gdpicture4s.ocx 4.7.0.1. This control is included in GdPicture Light Imaging Toolkit 4.7.1. Other versions may also be affected.
Exploit / POC
GdPicture Pro 'gdpicture4s.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into viewing a malicious web page.
The following example exploit code is available:
To exploit this issue, an attacker must entice an unsuspecting victim into viewing a malicious web page.
The following example exploit code is available:
Solution / Fix
GdPicture Pro 'gdpicture4s.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability
Solution:
The vendor has released GdPicture Pro Imaging SDK 5.7.2, which has a fixed version of the control. Please contact the vendor for information on obtaining and deploying the updated version.
Solution:
The vendor has released GdPicture Pro Imaging SDK 5.7.2, which has a fixed version of the control. Please contact the vendor for information on obtaining and deploying the updated version.
References
GdPicture Pro 'gdpicture4s.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability
References:
References:
- GdPicture Homepage (GdPicture)
- GdPicture Pro Imaging SDK Ver. 5.7.2 (20 September 2008) (GdPicture)