Oracle Hyperion Strategic Finance 'TTF16.ocx' ActiveX Control Buffer Overflow Vulnerability

Bugtraq ID:	50565
Class:	Input Validation Error
CVE:	CVE-2011-5167
Remote:	Yes
Local:	No
Published:	Nov 07 2011 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	rgod
Vulnerable:	Oracle Hyperion Strategic Finance 12.0
Not Vulnerable:

Oracle Hyperion Strategic Finance 'TTF16.ocx' ActiveX Control Buffer Overflow Vulnerability

Oracle Hyperion Strategic Finance is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using an affected ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

Oracle Hyperion Strategic Finance 12.0 is vulnerable; other versions may also be affected.

Oracle Hyperion Strategic Finance 'TTF16.ocx' ActiveX Control Buffer Overflow Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a specially crafted webpage.

The following exploit is available:

• /data/vulnerabilities/exploits/50565.html

Oracle Hyperion Strategic Finance 'TTF16.ocx' ActiveX Control Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Hyperion Strategic Finance 'TTF16.ocx' ActiveX Control Buffer Overflow Vulnerability

References:

• Oracle Hyperion Strategic Finance Client 12.x Remote Heap Overflow (rgod)
  
• Oracle Hyperion Strategic Finance Page (Oracle)