The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Macrovision InstallShield InstallScript One-Click Install Untrusted
Library Loading Vulnerability
------------------------------------------------------------------------
SUMMARY
Macrovision <InstallShield> InstallShield InstallScript One-Click Install
(OCI) is "a web based installer technology that allows software publishers
to distribute minimal installer packages which allow end users to select
components to install. Upon first visiting such a website, the user is
prompted to install the ActiveX control". Remote exploitation of an
untrusted library loading vulnerability in Macrovision's InstallShield
InstallScript One-Click Install ActiveX control allows remote attackers to
execute code with the privileges of the currently logged in user.
DETAILS
Vulnerable Systems:
* Macrovision InstallShield InstallScript One-Click Install ActiveX
Control version 12.0
Immune Systems:
* Macrovision InstallShield InstallScript One-Click Install ActiveX
Control version 12.0 with SP2
InstallShield InstallScript "One-Click Install" is implemented in an
ActiveX control with the following properties:
File: %WINDIR%\Downloaded Program Files\setup.exe
CLSID: 53D40FAA-4E21-459f-AA87-E4D97FC3245A
This control is marked "safe for scripting".
When a user visits a website from which a web install can be performed,
the ActiveX control downloads and loads several DLL files from the remote
website. Since no sanity checks are performed on the DLL files, an
attacker can substitute specially crafted libraries that will execute
arbitrary code when loaded.
Analysis:
Exploitation allows attackers to execute arbitrary code with the
privileges of the currently logged-in user. In order for exploitation to
occur, users would be required to have a vulnerable version of the ActiveX
control installed and be lured to a malicious site.
Workaround:
Administrators can set the kill-bit for the vulnerable ActiveX control
with the following .reg file. This will prevent the control from loading
within Internet Explorer.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX
Compatibility\{53D40FAA-4E21-459f-AA87-E4D97FC3245A}]
"Compatibility Flags"=dword:00000400
Vendor response:
Macrovision has addressed this vulnerability by releasing a hotfix for the
following products.
FLEXnet InstallShield 12 Professional (with InstallShield 12 SP2)
FLEXnet InstallShield 12 Premier (with InstallShield 12 SP2)
For more information, consult their Knowledge Base article at the
following URL.
<http://knowledge.macrovision.com/selfservice/microsites/search.do?cmd=displayKC&externalId=Q113640>
http://knowledge.macrovision.com/selfservice/microsites/search.do?cmd=displayKC&externalId=Q113640
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5661>
CVE-2007-5661
Disclosure timeline:
01/08/2007 - Initial vendor notification
04/17/2007 - Second vendor notification
04/18/2007 - Initial vendor response
03/31/2008 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=649>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=649
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
