Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'ExportEdaBom()' Insecure Method Vulnerability

Bugtraq ID:	50332
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 24 2011 12:00AM
Updated:	Oct 24 2011 12:00AM
Credit:	rgod
Vulnerable:	Oracle AutoVue 20.0.1
Not Vulnerable:

Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'ExportEdaBom()' Insecure Method Vulnerability

Oracle AutoVue 'AutoVueX.ocx' ActiveX control is prone to a vulnerability caused by an insecure method.

Successfully exploiting this issue will allow attackers to create or overwrite arbitrary files on a victim's computer within the context of the affected application (typically Internet Explorer) that uses the ActiveX control.

Oracle AutoVue 20.0.1 is vulnerable; other versions may also be affected.

Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'ExportEdaBom()' Insecure Method Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web page.

The following exploit file is available:

• /data/vulnerabilities/exploits/50332.txt

Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'ExportEdaBom()' Insecure Method Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'ExportEdaBom()' Insecure Method Vulnerability

References:

• Oracle AutoVue (Oracle)