Imera Systems ImeraIEPlugin ActiveX Control Arbitrary File Download Vulnerability

Bugtraq ID:	33993
Class:	Input Validation Error
CVE:	CVE-2009-0813
Remote:	Yes
Local:	No
Published:	Mar 03 2009 12:00AM
Updated:	Mar 10 2009 09:26PM
Credit:	Elazar Broad
Vulnerable:	Imera Systems ImeraIEPlugin 1.0.2 .54
Not Vulnerable:

Imera Systems ImeraIEPlugin ActiveX Control Arbitrary File Download Vulnerability

Imera Systems ImeraIEPlugin ActiveX control is prone to a vulnerability that can allow malicious files to be downloaded and saved to arbitrary locations on an affected computer.

This issue affects ImeraIEPlugin.dll 1.0.2.54; other versions may be affected as well.

Imera Systems ImeraIEPlugin ActiveX Control Arbitrary File Download Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to view a malicious webpage.

An exploit is available:

• /data/vulnerabilities/exploits/33993.html

Imera Systems ImeraIEPlugin ActiveX Control Arbitrary File Download Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Imera Systems ImeraIEPlugin ActiveX Control Arbitrary File Download Vulnerability

References:

• Home Page (Imera Systems)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)