Signature Detail
Short Name |
HTTP:STC:CLSID:ACTIVEX:JINIT-AX |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Oracle JInitiator Unsafe ActiveX Control |
Release Date |
2007/09/21 |
Update Number |
1213 |
Supported Platforms |
idp-4.0.110090709+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Oracle JInitiator Unsafe ActiveX Control
This signature detects attempts to exploit a known vulnerability in Oracle JInitiator. An attacker can create malicious Web pages containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.
Extended Description
Oracle JInitiator is prone to multiple remote buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. Exploiting these issues allows remote attackers to execute arbitrary code in the context of applications using the affected ActiveX control and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions. These issues affect Oracle JInitiator 1.1.8.16; other versions may also be affected.
Affected Products
- Oracle JInitiator 1.1.8.16
References
- BugTraq: 25473
- CVE: CVE-2007-4467
- URL: http://www.kb.cert.org/vuls/id/474433