Signature Detail
Short Name |
HTTP:STC:ACTIVEX:GDPICTUREPRO |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
GdPicture Pro gdpicture4s.ocx Unsafe ActiveX Control |
Release Date |
2012/11/06 |
Update Number |
2201 |
Supported Platforms |
idp-4.0.110090709+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: GdPicture Pro gdpicture4s.ocx Unsafe ActiveX Control
This signature detects attempts to use an unsafe ActiveX control in GdPicture Pro. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.
Extended Description
An ActiveX control in GdPicture Pro SDK is prone to a vulnerability that lets attackers overwrite files with arbitrary, attacker-controlled content. The issue occurs because the control fails to sanitize user-supplied input. Successful exploits may compromise affected computers and could aid in further attacks. This issue affects gdpicture4s.ocx 4.7.0.1. This control is included in GdPicture Light Imaging Toolkit 4.7.1. Other versions may also be affected.
Affected Products
- GdPicture GdPicture Light Imaging Toolkit 4.7.1
- GdPicture GdPicture Pro
References
- BugTraq: 31504
- CVE: CVE-2008-4453