GIGABYTE Dldrv2 ActiveX Control Multiple Vulnerabilities

Bugtraq ID:	41698
Class:	Unknown
CVE:	CVE-2010-1517 CVE-2010-1518
Remote:	Yes
Local:	No
Published:	Jul 15 2010 12:00AM
Updated:	Jul 15 2010 12:00AM
Credit:	Secunia Research
Vulnerable:	Gigabyte Dldrv2 ActiveX Control 1.4.206 11
Not Vulnerable:

GIGABYTE Dldrv2 ActiveX Control Multiple Vulnerabilities

The GIGABYTE Dldrv2 ActiveX Control is prone to multiple insecure-method vulnerabilities and an array-indexing overflow vulnerability.

Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files, to overwrite memory and to execute arbitrary code.

GIGABYTE Dldrv2 ActiveX Control 1.4.206.11 is vulnerable; other versions may also be affected.

GIGABYTE Dldrv2 ActiveX Control Multiple Vulnerabilities

An attacker can use a browser to exploit the array-index overflow issue. To exploit the insecure method issue, the attacker must entice an unsuspecting user to visit a malicious webpage.

GIGABYTE Dldrv2 ActiveX Control Multiple Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GIGABYTE Dldrv2 ActiveX Control Multiple Vulnerabilities

References:

• Product Page (Gigabyte)
  
• Secunia Research: GIGABYTE Dldrv2 ActiveX Control Array Indexing Vulnerability (Secunia)
  
• Secunia Research: GIGABYTE Dldrv2 ActiveX Control Unsafe Methods (Secunia)