Newv SmartClient 'NewvCommon.ocx' ActiveX Control Multiple Vulnerabilities
BID:45751
Info
Newv SmartClient 'NewvCommon.ocx' ActiveX Control Multiple Vulnerabilities
| Bugtraq ID: | 45751 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 10 2011 12:00AM |
| Updated: | Jan 10 2011 12:00AM |
| Credit: | wsn1983 and yuguo.cn |
| Vulnerable: |
NewV NewV smartclient 1.1 0 |
| Not Vulnerable: | |
Discussion
Newv SmartClient 'NewvCommon.ocx' ActiveX Control Multiple Vulnerabilities
The Newv SmartClient ActiveX control is prone to multiple insecure-method vulnerabilities and a stack-based buffer-overflow vulnerability.
Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files, to delete arbitrary files, and to execute arbitrary code. Failed exploit attempts will result in a denial-of-service condition.
Newv SmartClient 1.1.0.0 is vulnerable; other versions may also be affected.
The Newv SmartClient ActiveX control is prone to multiple insecure-method vulnerabilities and a stack-based buffer-overflow vulnerability.
Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files, to delete arbitrary files, and to execute arbitrary code. Failed exploit attempts will result in a denial-of-service condition.
Newv SmartClient 1.1.0.0 is vulnerable; other versions may also be affected.
Exploit / POC
Newv SmartClient 'NewvCommon.ocx' ActiveX Control Multiple Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting user to view a malicious web page.
The following exploit code is available:
To exploit these issues, an attacker must entice an unsuspecting user to view a malicious web page.
The following exploit code is available:
Solution / Fix
Newv SmartClient 'NewvCommon.ocx' ActiveX Control Multiple Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Newv SmartClient 'NewvCommon.ocx' ActiveX Control Multiple Vulnerabilities
References:
References:
- Vendor Homepage (Newv)
- nansec Vulnerability Reference (nansec)
- Neohapsis Archives (Neohapsis)