Danske Bank Danske e-Sec Control Module ActiveX Control Buffer Overflow Vulnerability

Bugtraq ID:	34549
Class:	Boundary Condition Error
CVE:	CVE-2008-1107
Remote:	Yes
Local:	No
Published:	Apr 16 2009 12:00AM
Updated:	Jun 08 2010 06:19PM
Credit:	Carsten Eiram
Vulnerable:	Danske Bank DanskeSikker.ocx 3.1 .48
Not Vulnerable:

Danske Bank Danske e-Sec Control Module ActiveX Control Buffer Overflow Vulnerability

Danske Bank Danske e-Sec Control Module ActiveX control is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

This issue affects Danske e-Sec Control Module ActiveX control (DanskeSikker.ocx) 3.1.0.48; other versions may be vulnerable as well.

Danske Bank Danske e-Sec Control Module ActiveX Control Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Danske Bank Danske e-Sec Control Module ActiveX Control Buffer Overflow Vulnerability

Solution:
Updates are available to address this issue. Please see the references for more information.

Danske Bank Danske e-Sec Control Module ActiveX Control Buffer Overflow Vulnerability

References:

• Danske Bank e-Sec Control Module Error Logging Buffer Overflow (Secunia)
  
• Danske Bank Home Page (Danske Bank)
  
• Danske Netbetaling (Danske Bank)
  
• Microsoft Support Document 240797 (Microsoft)
  
• Secunia Research: Danske Bank e-Sec Control Module Error Logging Buffer Overflow (Secunia Research )
  
• Microsoft Security Bulletin MS10-034 (Microsoft)