The Internet Pictures Corporation iPIX Image Well ActiveX controls contain buffer overflows, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Internet Pictures Corporation has produced equipment and software to create 360 degree field-of-view images. The Internet Pictures Corporation iPIX Image Well ActiveX control, provided by iPIX-ImageWell-ipix.dll, contains several buffer overflow vulnerabilities.
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause Internet Explorer (or the program using the WebBrowser control) to crash.
We are currently unaware of a practical solution to this problem. Internet Pictures Corporation has apparently filed for bankruptcy and does not appear to still be in business.
Disable the iPIX Image Well ActiveX controls in Internet Explorer
This vulnerability was reported by Will Dormann of CERT/CC.
This document was written by Will Dormann.
|Date First Published:||2007-04-09|
|Date Last Updated:||2007-04-09 17:07 UTC|