MarkAny ContentSAFER 'MASetupCaller' ActiveX Control Multiple Insecure Method Vulnerabilities

Bugtraq ID:	55192
Class:	Input Validation Error
CVE:	CVE-2012-2990
Remote:	Yes
Local:	No
Published:	Aug 23 2012 12:00AM
Updated:	Aug 23 2012 12:00AM
Credit:	Will Dormann
Vulnerable:
Not Vulnerable:

MarkAny ContentSAFER 'MASetupCaller' ActiveX Control Multiple Insecure Method Vulnerabilities

MarkAny ContentSAFER is prone to multiple insecure-method vulnerabilities.

Successfully exploiting these issues will allow attackers to download and execute arbitrary files on the victim's computer within the context of the affected application (typically Internet Explorer) that uses the ActiveX control.

MarkAny ContentSAFER MASetupCaller ActiveX control versions prior to 1.4.2012.508 are vulnerable.

MarkAny ContentSAFER 'MASetupCaller' ActiveX Control Multiple Insecure Method Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim into viewing a malicious webpage.

MarkAny ContentSAFER 'MASetupCaller' ActiveX Control Multiple Insecure Method Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

MarkAny ContentSAFER 'MASetupCaller' ActiveX Control Multiple Insecure Method Vulnerabilities

References:

• MarkAny Content SAFER Product HomePage (MarkAny)
  
• Samsung KIES HomePage (Samsung)
  
• MarkAny ContentSAFER MASetupCaller ActiveX control arbitrary download and execut (US-CERT)