Signature Detail
Short Name |
HTTP:STC:ACTIVEX:HPIS-DATA-MGR |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
HP Instant Support HPISDataManager.dll Unsafe ActiveX Control |
Release Date |
2012/11/05 |
Update Number |
2200 |
Supported Platforms |
idp-4.0.110090709+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: HP Instant Support HPISDataManager.dll Unsafe ActiveX Control
This signature detects attempts to use an unsafe ActiveX control in HP Instant Support. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.
Extended Description
HP Instant Support ActiveX control in 'HPISDataManager.dll' is prone to a vulnerability that lets attackers download arbitrary files. Attackers may exploit this issue by enticing victims into visiting a maliciously crafted webpage. Successful exploits will allow remote attackers to download files from arbitrary locations to the affected computer. The attacker can also specify arbitrary download locations on the target system. NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.
Affected Products
- HP Instant Support 1.0.0.22
References
- BugTraq: 29529
- BugTraq: 29530
- BugTraq: 29536
- BugTraq: 29535
- BugTraq: 29533
- BugTraq: 29534
- BugTraq: 29532
- BugTraq: 29531
- BugTraq: 29526
- CVE: CVE-2007-5608
- CVE: CVE-2007-5607
- CVE: CVE-2007-5610
- CVE: CVE-2007-5605
- CVE: CVE-2007-5606
- CVE: CVE-2008-0952
- CVE: CVE-2008-0953
- CVE: CVE-2007-5604