SAP NetWeaver Business Client ActiveX Control Multiple Remote Code Execution Vulnerabilities

Bugtraq ID:	45396
Class:	Unknown
CVE:	CVE-2010-4556
Remote:	Yes
Local:	No
Published:	Dec 14 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	Alexandr Polyakov, Alexey Sintsov from Digital Security Research Group
Vulnerable:	SAP NetWeaver Business Client 0
Not Vulnerable:

SAP NetWeaver Business Client ActiveX Control Multiple Remote Code Execution Vulnerabilities

SAP NetWeaver Business Client SapThemeRepository ('sapwdpcd.dll') ActiveX control is prone to multiple remote code-execution vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting user to view a malicious webpage.

Successfully exploiting these issues will allow attackers to execute arbitrary within the context of the application (typically Internet Explorer) that uses the ActiveX control.

SAP NetWeaver Business Client ActiveX Control Multiple Remote Code Execution Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SAP NetWeaver Business Client ActiveX Control Multiple Remote Code Execution Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

SAP NetWeaver Business Client ActiveX Control Multiple Remote Code Execution Vulnerabilities

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)