MW6 Technologies Barcode ActiveX Control 'Supplement' Heap Buffer Overflow Vulnerability

Bugtraq ID:	33451
Class:	Boundary Condition Error
CVE:	CVE-2009-0298
Remote:	Yes
Local:	No
Published:	Jan 26 2009 12:00AM
Updated:	Apr 13 2015 09:11PM
Credit:	Houssamix
Vulnerable:	MW6 Technologies Barcode ActiveX 3.0.0.1
Not Vulnerable:	MW6 Technologies Barcode ActiveX 4.0

MW6 Technologies Barcode ActiveX Control 'Supplement' Heap Buffer Overflow Vulnerability

MW6 Technologies Barcode ActiveX control is prone to a heap-based buffer-overflow vulnerability because the application fails to adequately check boundaries on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed attacks will likely cause denial-of-service conditions.

MW6 Technologies Barcode ActiveX Control 'Supplement' Heap Buffer Overflow Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/33451.html

MW6 Technologies Barcode ActiveX Control 'Supplement' Heap Buffer Overflow Vulnerability

Solution:
Updates are available. Please contact the vendor for more information.

MW6 Technologies Barcode ActiveX Control 'Supplement' Heap Buffer Overflow Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Vendor Homepage (MW6 Technologies)