Dell DellSystemLite.Scanner ActiveX Control Multiple Vulnerabilities

Bugtraq ID:	46443
Class:	Input Validation Error
CVE:	CVE-2011-0329 CVE-2011-0330
Remote:	Yes
Local:	No
Published:	Feb 18 2011 12:00AM
Updated:	Feb 18 2011 12:00AM
Credit:	Dmitriy Pletnev of Secunia Research.
Vulnerable:	Dell DellSystemLite.ocx 1.0.0.0
Not Vulnerable:

Dell DellSystemLite.Scanner ActiveX Control Multiple Vulnerabilities

The DellSystemLite.Scanner ActiveX control is prone to a directory-traversal vulnerability and an information-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to obtain sensitive information.

DellSystemLite.ocx 1.0.0.0 is vulnerable; other versions may also be affected.

Dell DellSystemLite.Scanner ActiveX Control Multiple Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Dell DellSystemLite.Scanner ActiveX Control Multiple Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Dell DellSystemLite.Scanner ActiveX Control Multiple Vulnerabilities

References:

• Dell DellSystemLite.Scanner ActiveX Control "GetData()" Directory Traversal (Secunia)
  
• DellSystemLite.Scanner ActiveX Control "WMIAttributesOfInterest" Unsafe Property (Secunia)
  
• Vendor Homepage (Dell)