Autodesk IDrop ActiveX Control 'IDrop.ocx' Multiple Heap Memory Corruption Vulnerabilities
BID:34352
Info
Autodesk IDrop ActiveX Control 'IDrop.ocx' Multiple Heap Memory Corruption Vulnerabilities
| Bugtraq ID: | 34352 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 02 2009 12:00AM |
| Updated: | Jun 05 2009 04:09PM |
| Credit: | Elazar Broad |
| Vulnerable: |
Autodesk IDrop 17.1.51.160 |
| Not Vulnerable: | |
Discussion
Autodesk IDrop ActiveX Control 'IDrop.ocx' Multiple Heap Memory Corruption Vulnerabilities
Autodesk IDrop ActiveX control is prone to multiple heap-based memory-corruption vulnerabilities.
An attacker can exploit these issues to execute arbitrary code within the context of the application that invoked the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.
Autodesk IDrop ActiveX control 17.1.51.160 is vulnerable; other versions may also be affected.
Autodesk IDrop ActiveX control is prone to multiple heap-based memory-corruption vulnerabilities.
An attacker can exploit these issues to execute arbitrary code within the context of the application that invoked the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.
Autodesk IDrop ActiveX control 17.1.51.160 is vulnerable; other versions may also be affected.
Exploit / POC
Autodesk IDrop ActiveX Control 'IDrop.ocx' Multiple Heap Memory Corruption Vulnerabilities
UPDATE (June 5, 2009): Symantec has detected active exploit attempts of this issue in the wild.
The following exploit is available:
UPDATE (June 5, 2009): Symantec has detected active exploit attempts of this issue in the wild.
The following exploit is available:
Solution / Fix
Autodesk IDrop ActiveX Control 'IDrop.ocx' Multiple Heap Memory Corruption Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Autodesk IDrop ActiveX Control 'IDrop.ocx' Multiple Heap Memory Corruption Vulnerabilities
References:
References:
- I-drop ActiveX Control Homepage (Autodesk)
- Microsoft Knowledge Base Article 240797 (Microsoft)
- Autodesk IDrop ActiveX Control Heap Corruption Vulnerability ("Elazar Broad"