The Husdawg, LLC. System Requirements Lab ActiveX control and Java applet allow an unauthenticated remote attacker to download and execute arbitrary code.
Husdawg, LLC. provides an ActiveX control and signed Java Applet that are used for benchmarking the capabilities of a PC. The ActiveX control is provided by sysreqlab.dll, sysreqlabsli.dll, or sysreqlab2.dll, and the Java version is provided by SRLApplet.class, which may be contained in sysreqlab2.jar or sysreqlab.jar. The software is commonly used to determine if a system meets the requirements necessary to run video games. The System Requirements Lab components can be scripted to request an executable file from that server, which is then immediately executed. This file may be retrieved over HTTP, HTTPS, or FTP protocols.
A remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable server.
Apply an update
This vulnerability is addressed in version 3 of the System Requirements Lab software. This version is available on the systemrequirementlab.com web server. This version of the ActiveX control restricts which domains can call the methods provided by the control.
This vulnerability was reported by Andre Protas of eEye Digital Security, who in turn credit Greg Linares. Additional information about vulnerable components was provided by Will Dormann of the CERT/CC.
This document was written by Will Dormann.
|Date First Published:||2008-10-14|
|Date Last Updated:||2008-10-20 12:08 UTC|