----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
WebArchiveX ActiveX Control Insecure Methods

SECUNIA ADVISORY ID:
SA16722

VERIFY ADVISORY:
http://secunia.com/advisories/16722/

CRITICAL:
Moderately critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
WebArchiveX 5.x
http://secunia.com/product/5674/

DESCRIPTION:
Brett Moore has reported a vulnerability in WebArchiveX, which can be
exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the ActiveX control supporting
some insecure methods and is marked "safe for scripting". This can be
exploited to execute arbitrary commands during system startup by
writing a ".MHT" file into the user's startup folder using the
"MakeArchive()" API method. It is also a possible to read arbitrary
files using the "MakeArchiveStr()" method.

Successful exploitation requires that the user is e.g. tricked into
visiting a malicious web site.

The vulnerability has been reported in version 5.5.0.76 installed
prior to 2005-09-06.

SOLUTION:
Version 5.5.0.76 installed on 2005-09-06 and later will not have the
ActiveX control marked as "safe for scripting".

Existing users should remove "safe for scripting" keys from the
ActiveX control's registry entries and restrict use of ActiveX
controls to trusted web sites only.

PROVIDED AND/OR DISCOVERED BY:
Brett Moore, Security-Assessment.com.

ORIGINAL ADVISORY:
http://www.security-assessment.com/Advisories/WebArchiveX_-_Unsafe_Methods_Vulnerability.pdf

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------