Synactis All-In-The-Box ActiveX Remote Code Execution Vulnerability

  1. Network Vulnerabilities
  2. Buffer overflow
  3. Synactis All-In-The-Box ActiveX Remote Code Execution Vulnerability
Summary
This host is installed with All-In-The-Box ActiveX and is prone to Remote Code Execution Vulnerability.
Impact
Successful exploitation will let the attacker overwrite arbitrary files on the system via a filename terminated by a NULL byte. Impact Level: System/Application
Solution
Upgrade to Synactis, All-In-The-Box ActiveX version 4.02 or later For updates refer to http://synactis.com/pdf-in-the-box-downloads.asp
Insight
This flaw is due to an ActiveX control All_In_The_Box.ocx providing insecure SaveDoc method.
Affected
Synactis, All-In-The-Box ActiveX version 3.1.2.0 and prior. Workaround: Set the Killbit for the vulnerable CLSID {B5576893-F948-4E0F-9BE1-A37CB56D66FF} http://support.microsoft.com/kb/240797
References
Updated on 2017-03-28
Severity
High Severity
Classification
Related Vulnerabilities