IBM SPSS SamplePower 'Vsflex8l' ActiveX Control CVE-2012-5945 Buffer Overflow Vulnerability
BID:59557
Info
IBM SPSS SamplePower 'Vsflex8l' ActiveX Control CVE-2012-5945 Buffer Overflow Vulnerability
| Bugtraq ID: | 59557 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2012-5945 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 26 2013 12:00AM |
| Updated: | Jun 12 2013 06:36PM |
| Credit: | Alexander Gavrun |
| Vulnerable: |
IBM SPSS SamplePower 3.0 |
| Not Vulnerable: | |
Discussion
IBM SPSS SamplePower 'Vsflex8l' ActiveX Control CVE-2012-5945 Buffer Overflow Vulnerability
IBM SPSS SamplePower is prone to a buffer-overflow vulnerability because it fails to properly bounds check the data.
Attackers can exploit this issue to execute arbitrary code within the context of an application (typically Internet Explorer) that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service condition.
IBM SPSS SamplePower 3.0 is vulnerable; other versions may also be affected.
IBM SPSS SamplePower is prone to a buffer-overflow vulnerability because it fails to properly bounds check the data.
Attackers can exploit this issue to execute arbitrary code within the context of an application (typically Internet Explorer) that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service condition.
IBM SPSS SamplePower 3.0 is vulnerable; other versions may also be affected.
Exploit / POC
IBM SPSS SamplePower 'Vsflex8l' ActiveX Control CVE-2012-5945 Buffer Overflow Vulnerability
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
IBM SPSS SamplePower 'Vsflex8l' ActiveX Control CVE-2012-5945 Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM SPSS SamplePower 'Vsflex8l' ActiveX Control CVE-2012-5945 Buffer Overflow Vulnerability
References:
References:
- IBM Homepage (IBM)