Gator Insecure ActiveX Control Vulnerability
BID:4161
Info
Gator Insecure ActiveX Control Vulnerability
| Bugtraq ID: | 4161 |
| Class: | Design Error |
| CVE: |
CVE-2002-0317 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 20 2002 12:00AM |
| Updated: | Jul 11 2009 10:56AM |
| Credit: | Discovered by obscure <[email protected]> |
| Vulnerable: |
Gator Gator 3.0.6 .0 |
| Not Vulnerable: | |
Discussion
Gator Insecure ActiveX Control Vulnerability
Gator is a software package for Windows computers designed to automatically populate web based forms.
Gator is installed through an ActiveX control, which downloads and executes an installation program from the Gator web site. This ActiveX control remains installed after the Gator installation is complete.
It has been reported that this ActiveX control may be passed a url to any file named 'setup.ex_', and may be called by arbitrary web pages. A malicous web page may use this control to download and execute arbitrary code on a vulnerable client machine. User interaction is not required.
Earlier versions of Gator may also contain this insecure component.
Gator is a software package for Windows computers designed to automatically populate web based forms.
Gator is installed through an ActiveX control, which downloads and executes an installation program from the Gator web site. This ActiveX control remains installed after the Gator installation is complete.
It has been reported that this ActiveX control may be passed a url to any file named 'setup.ex_', and may be called by arbitrary web pages. A malicous web page may use this control to download and execute arbitrary code on a vulnerable client machine. User interaction is not required.
Earlier versions of Gator may also contain this insecure component.