|
|
|
|
| |
Credit:
The information has been provided by iDefense Labs.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=618
|
| |
Vulnerable Systems:
* Macrovision InstallShield Update version 5.01.100.47363, and 6.0.100.60146
The Update Service is implemented as an ActiveX control with the following properties:
CLSID: E9880553-B8A7-4960-A668-95C68BED571E
File: C:\Windows\Downloaded Files\isusweb.dll
Version: 5.01.100.47363, and 6.0.100.60146
This control is marked "safe for scripting". Several methods within this control can be utilized by attackers to download and launch arbitrary executables.
Analysis:
Exploitation allows attackers to execute arbitrary code with the privileges of the currently logged-in user. In order for exploitation to occur, users would be required to have a vulnerable version of the software installed and be lured to a malicious site. Even though the update control does display an interface, no additional interaction is required in order for exploitation to occur.
Since this control is marked "safe for scripting", it can be launched from a web page without warning dialogs. While it is possible for an alert user to determine what is occurring and cancel the installation, the window of opportunity is small and based solely upon the time required for the system to complete the download.
Workaround:
Administrators can set the kill-bit for the vulnerable ActiveX control with the following .reg file. This will prevent the control from loading within Internet Explorer.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E9880553-B8A7-4960-A668-95C68BED571E}]
"Compatibility Flags"=dword:00000400
Vendor response:
Macrovision has addressed this vulnerability by releasing updated versions of their FlexNet and InstallShield products. They report that the new versions are no longer marked as "safe for scripting". For more information, consult the following URL: http://www.macrovision.com/promolanding/7660.htm
CVE Information:
CVE-2007-5660
Disclosure timeline:
09/24/2007 - Initial vendor notification
09/24/2007 - Initial vendor response
10/31/2007 - Coordinated public disclosure
|
|
|
|
|
