flexnet-overwrite.txt

`Who:  
Macrovision  
  
What:  
Macrovision FlexNext Connect is a software package that allows   
ISV's to update their software products. It is generally used in   
conjunction with the InstallShield software deploymnet framework.  
  
FlexNet uses a number of ActiveX controls, some of which are marked   
safe for scripting, in this case, the DownloadManager object:  
  
ISDM.exe version 6.1.100.61372  
MVSNClientDownloadManager61Lib.DownloadManager  
{FCED4482-7CCB-4E6F-86C9-DCB22B52843C}  
IObjectSafety:  
IO. Safe for scripting (IDispatch)  
  
How:  
This control contains several methods which can be used to silently   
download arbitrary files to the system and possibly overwrite files   
in the context of the user.  
  
Workaround:  
Set the killbit for this control and the Basket control(see Notes),   
see http://support.microsoft.com/kb/240797  
  
Fix:  
None  
  
Exploit;  
http://milw0rm.com/exploits/4909  
  
Notes:  
The Basket object {1DF951B1-8D40-4894-A04C-66AD824A0EEF} of   
isusweb.dll can be used in a similar manner to download and execute   
files on a system via the ISDM scheduling framework, however, it   
does so visibly.  
  
I understand that some of this functionality is by design, however,   
there should be some validation in place to verify that the files   
that are being downloaded are indeed from a trusted source and are   
  
--  
Click here and choose from thousands of high quality used cars.  
http://tagline.hushmail.com/fc/Ioyw6h4fKQ1cTGSIM7gFWipCcboNGVFhKad0XVtWL17fgTXnXnvcla/  
updates to packages that are actually installed on the system.   
  
`