|
|
|
Vulnerability Note VU#847993Macrovision FLEXnet Connect / InstallShield Update Service Agent ActiveX buffer overflowOverviewThe Macrovision / InstallShield Update Service Web Agent ActiveX control contains a buffer overflow, which could allow an attacker to execute arbitrary code on a vulnerable system.I. DescriptionThe InstallShield Update Service, now known as Macrovision FLEXnet Connect, contains an ActiveX control called Update Service Agent. This ActiveX control is a component that is included with some Macrovision and InstallShield Windows software installers and is provided by the file isusweb.dll. The Update Service Agent ActiveX control contains a buffer overflow vulnerability in the Download() method.II. ImpactBy convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause Internet Explorer (or the program using the WebBrowser control) to crash.III. SolutionWe are currently unaware of a practical solution to this problem.Disable the Update Service Agent ActiveX control in Internet Explorer
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E9880553-B8A7-4960-A668-95C68BED571E}] "Compatibility Flags"=dword:00000400 Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this and other ActiveX vulnerabilities. Instructions for disabling ActiveX in the Internet Zone can be found in the "Securing Your Web Browser" document. Systems Affected
Referenceshttp://www.cert.org/tech_tips/securing_browser/#Internet_Explorer This vulnerability was reported by Dan Plakosh of the Software Engineering Institute. This document was written by Will Dormann.
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
|||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||