Tango DropBox ActiveX Control Remote Heap Buffer Overflow Vulnerability

Bugtraq ID:	75322
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 19 2015 12:00AM
Updated:	Jun 19 2015 12:00AM
Credit:	metacom
Vulnerable:	Tango DropBox Tango DropBox 3.1.5
Not Vulnerable:

Tango DropBox ActiveX Control Remote Heap Buffer Overflow Vulnerability

Tango DropBox is prone to a remote heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

Tango DropBox ActiveX Control Remote Heap Buffer Overflow Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/75322.html.txt

Tango DropBox ActiveX Control Remote Heap Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Tango DropBox ActiveX Control Remote Heap Buffer Overflow Vulnerability

References:

• Tango DropBox Homepage (Tango DropBox)