Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'Export3DBom()' Insecure Method Vulnerability

Bugtraq ID:	50333
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 24 2011 12:00AM
Updated:	Nov 23 2011 09:05AM
Credit:	rgod
Vulnerable:	Oracle AutoVue 20.0.1
Not Vulnerable:

Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'Export3DBom()' Insecure Method Vulnerability

Oracle AutoVue 'AutoVueX.ocx' ActiveX control is prone to a vulnerability caused by an insecure method.

Successfully exploiting this issue will allow attackers to create or overwrite arbitrary files on the victim's computer within the context of the affected application (typically Internet Explorer) that uses the ActiveX control.

Oracle AutoVue 20.0.1 is vulnerable; other versions may also be affected.

Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'Export3DBom()' Insecure Method Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web page.

The following exploit file is available:

• /data/vulnerabilities/exploits/50333.zip

Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'Export3DBom()' Insecure Method Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle AutoVue 'AutoVueX.ocx' ActiveX Control 'Export3DBom()' Insecure Method Vulnerability

References:

• Oracle AutoVue (Oracle)