Particle Software IntraLaunch ActiveX Control Remote Code Execution Vulnerability

Bugtraq ID:	34395
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 06 2009 12:00AM
Updated:	Apr 07 2009 08:27PM
Credit:	Will Dormann
Vulnerable:	Particle Software IntraLaunch 0
Not Vulnerable:

Particle Software IntraLaunch ActiveX Control Remote Code Execution Vulnerability

Particle Software IntraLaunch ActiveX Control is prone to a remote code-execution vulnerability. This control is identified by the following CLSIDs:

0AE533FE-B805-4FD6-8AE1-A619FBEE7A23
58FEBB79-70F5-48A6-9697-E91591DA3F8E
858B4F85-E945-4F0C-AF65-059E0AD9EEC0

An attacker can exploit this issue to execute arbitrary code in the context of the application using the vulnerable ActiveX control (typically Internet Explorer).

Particle Software IntraLaunch ActiveX Control Remote Code Execution Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into viewing a malicious webpage.

Particle Software IntraLaunch ActiveX Control Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Particle Software IntraLaunch ActiveX Control Remote Code Execution Vulnerability

References:

• LDRA Homepage (LDRA)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Particle Software Homepage (Particle Software)
  
• VU#908801 Particle Software IntraLaunch Application Launcher ActiveX control fai (US-CERT)