PcVue ActiveX multiple security vulnerabilities

Unsafe methods, array index overflow, code execution...

Vulnerabilities in PcVue 10 (SCADA)

Luigi Auriemma Application: PcVue http://www.arcinfo.com/index.php?option=comcontent&id=2&Itemid=151 Versions: PcVue = 10.0 SVUIGrd.ocx = 1.5.1.0 aipgctl.ocx = 1.07.3702 Platforms: Windows Bugs: A code execution in SVUIGrd.ocx Save/LoadObject B write4 in SVUIGrd.ocx GetExtendedColor C possible...

Siemens Automation License Manager Vulnerabilities

Overview This Advisory is a follow-up to the original Alert titled “ICS-ALERT-11-332-01A—Siemens Automation License Manager Vulnerabilities” that was published December 02, 2011, on the ICS-CERT web page. ICS-CERT is aware of publicly disclosed reports of four vulnerabilities in Siemens Automatio...

PcVue 10.0 - Multiple Vulnerabilities

Luigi Auriemma Application: PcVue http://www.arcinfo.com/index.php?option=comcontent&id=2&Itemid=151 Versions: PcVue = 10.0 SVUIGrd.ocx = 1.5.1.0 aipgctl.ocx = 1.07.3702 Platforms: Windows Bugs: A code execution in SVUIGrd.ocx Save/LoadObject B write4 in SVUIGrd.ocx GetExtendedColor C possible...

GOM Player ActiveX Control Buffer Overflow (CVE-2007-5779)

A remote code execution vulnerability has been reported in GOM player. The vulnerability is due to a boundary error in GOM while handling a certain method. A remote attacker may exploit this vulnerability by enticing an unsuspecting user to open a specially crafted HTML page. Successful...

HP Easy Printer Care Software HPTicketMgr.dll Directory Traversal (CVE-2011-2404)

A code execution vulnerability has been reported in HP Easy Printer Care Software. The vulnerability is due to insufficient input validation by an ActiveX control within the affected product. A remote attacker may exploit this vulnerability by enticing an affected user to open a malicious link...

Sunway ForceControl multiple security vulnerabilities

Multiple buffer overflows, DoS conditions, directory traversal, ActiveX code execution...

Vulnerabilities in Sunway ForceControl 6.1 sp3 (SCADA)

Luigi Auriemma Application: Sunway ForceControl http://www.sunwayland.com.cn/pro.asp Versions: = 6.1 sp3 with AngelServer and WebServer updated Platforms: Windows Bugs: various stack overflows directory traversals third party ActiveX code execution various Denials of Service Exploitation: remote...

sunway ForceControl 6.1 sp3 - Multiple Vulnerabilities

sunway ForceControl 6.1 sp3 - Multiple Vulnerabilities Luigi Auriemma Application: Sunway ForceControl http://www.sunwayland.com.cn/pro.asp Versions: B9 19000000 MOV ECX,19 004022E6 . 33C0 XOR EAX,EAX 004022E8 . 8D7C24 24 LEA EDI,DWORD PTR SS:ESP+24 004022EC . 83FE 64 CMP ESI,64 ; our value...

sunway ForceControl 6.1 sp3 - Multiple Vulnerabilities

Luigi Auriemma Application: Sunway ForceControl http://www.sunwayland.com.cn/pro.asp Versions: B9 19000000 MOV ECX,19 004022E6 . 33C0 XOR EAX,EAX 004022E8 . 8D7C24 24 LEA EDI,DWORD PTR SS:ESP+24 004022EC . 83FE 64 CMP ESI,64 ; our value 004022EF . F3:AB REP STOS DWORD PTR ES:EDI 004022F1 . 0F8D...

Citrix Access Gateway NESPA ActiveX Control

Added: 09/13/2011 CVE: CVE-2011-2882 BID: 48676 OSVDB: 74191 Background Citrix Access Gateway is an application remote-access solution. Problem The Citrix Access Gateway installs an ActiveX plug-in on the user's browser. Plug-in versions 8.1-67.7, 9.0-70.5, and 9.1-96.4 are vulnerable to a stack...

Citrix Access Gateway NESPA ActiveX Control

Added: 09/13/2011 CVE: CVE-2011-2882 BID: 48676 OSVDB: 74191 Background Citrix Access Gateway is an application remote-access solution. Problem The Citrix Access Gateway installs an ActiveX plug-in on the user's browser. Plug-in versions 8.1-67.7, 9.0-70.5, and 9.1-96.4 are vulnerable to a stack...

Citrix Access Gateway NESPA ActiveX Control

Added: 09/13/2011 CVE: CVE-2011-2882 BID: 48676 OSVDB: 74191 Background Citrix Access Gateway is an application remote-access solution. Problem The Citrix Access Gateway installs an ActiveX plug-in on the user's browser. Plug-in versions 8.1-67.7, 9.0-70.5, and 9.1-96.4 are vulnerable to a stack...

Citrix Access Gateway NESPA ActiveX Control

Added: 09/13/2011 CVE: CVE-2011-2882 BID: 48676 OSVDB: 74191 Background Citrix Access Gateway is an application remote-access solution. Problem The Citrix Access Gateway installs an ActiveX plug-in on the user's browser. Plug-in versions 8.1-67.7, 9.0-70.5, and 9.1-96.4 are vulnerable to a stack...

Siemens FactoryLink Multiple ActiveX Vulnerabilities

Overview ICS-CERT originally released Advisory ICSA-11-343-01P on the US-CERT secure portal on December 09, 2011. This web page release was delayed to allow users time to download and install the update. Researcher Kuang-Chun Hung of Taiwan’s Information and Communication Security Technology Cent...

ARC Informatique PcVue HMI/SCADA ActiveX Vulnerabilities

Overview This Advisory is a follow-up to the Alert, “ICS-ALERT-11-271-01 - ARC Informatique PcVue HMI/SCADA ActiveX Vulnerabilities.” ICS-CERT is aware of publicly and privately disclosed reports of four vulnerabilities in ARC Informatique’s PcVue application. These vulnerabilities include:...

Embarcadero ER/Studio XE2 Server Portal Code Execution

See: CVE-2011-2217 reference url: http://www.securityfocus.com/bid/48099 The mentioned product is vulnerable to the same issue. download url: https://downloads.embarcadero.com/free/erstudioportal ActiveX settings: ProgID: TomSawyer.DefaultExtFactory.5.5.3.238.VS7.1 CLSID:...

Apple QuickTime 7.6.9 - QuickTimePlayer.dll ActiveX Buffer Overflow

Apple QuickTime 7.6.9 - QuickTimePlayer.dll ActiveX Buffer Overflow source: https://www.securityfocus.com/bid/49465/info Apple QuickTime is prone to a buffer-overflow vulnerability because of a failure to properly bounds-check user-supplied data. Successful exploits will allow attackers to execut...

Apple QuickTime 7.6.9 - 'QuickTimePlayer.dll' ActiveX Buffer Overflow

source: https://www.securityfocus.com/bid/49465/info Apple QuickTime is prone to a buffer-overflow vulnerability because of a failure to properly bounds-check user-supplied data. Successful exploits will allow attackers to execute arbitrary code in the context of the currently logged-in user;...

Vulnerabilities in BroadWin WebAccess Client 1.0.0.10

Luigi Auriemma Application: BroadWin WebAccess Client http://broadwin.com/Client.htm Versions: bwocxrun.ocx = 1.0.0.10 aka version 7.0 Platforms: Windows Bugs: A format string B arbitrary memory corruption Exploitation: remote Date: 02 Sep 2011 Author: Luigi Auriemma e-mail: [email protected]...