Image22 ActiveX Control "DrawIcon()" Buffer Overflow Vulnerability

[Peaches]

<h4></h4>

Secunia Advisory SA40543

Image22 ActiveX Control "DrawIcon()" Buffer Overflow Vulnerability

Highly critical

Description

A vulnerability has been discovered in Image22 ActiveX control, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the handling of the "DrawIcon()" method when processing the file extension argument and can be exploited to cause a stack-based buffer overflow.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 1.1.1.0. Other versions may also be affected.

Solution

Set the kill-bit for the ActiveX control.

http://secunia.com/advisories/40543/