iMesh 'IMWebControl.dll' ActiveX Control Buffer Overflow Vulnerability

Bugtraq ID:	48550
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 04 2011 12:00AM
Updated:	Jul 04 2011 12:00AM
Credit:	KedAns-Dz
Vulnerable:	iMesh iMesh 10.0
Not Vulnerable:

iMesh 'IMWebControl.dll' ActiveX Control Buffer Overflow Vulnerability

iMesh is prone to a buffer overflow vulnerability because the application fails to perform adequate boundary-checks on user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using an affected ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

iMesh 10.0 is vulnerable; other versions may also be affected.

iMesh 'IMWebControl.dll' ActiveX Control Buffer Overflow Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a specially crafted web
document.

The following exploit is available:

• /data/vulnerabilities/exploits/48550.html

iMesh 'IMWebControl.dll' ActiveX Control Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

iMesh 'IMWebControl.dll' ActiveX Control Buffer Overflow Vulnerability

References:

• iMesh <= 10.0 (IMWebControl.dll) Remote Buffer Overflow Exploit (iMesh)
  
• Vendor Homepage (iMesh.com)