The host is installed with SigPlus Pro ActiveX Control and is prone to multiple vulnerabilities.

Successful exploitation could allow attackers to create or overwrite arbitrary local files and to execute arbitrary code. Impact Level: Application

Upgrade to the Topaz Systems SigPlus Pro ActiveX Control Version 4.29 or later. For updates refer to http://www.topazsystems.com/Software/download/sigplusactivex.htm

The flaws are due to - A boundary error when processing the 'KeyString' property which can be exploited to cause a heap-based buffer overflow via an overly long string. - A boundary error when processing the 'SetLocalIniFilePath()' method, and 'SetTabletPortPath()' method can be exploited to cause a heap-based buffer overflow via an overly long string passed in the 'NewPath' and 'NewPortPath' parameter respectively. - An unsafe 'SetLogFilePath()' method creating a log file in a specified location which can be exploited in combination with the 'SigMessage()' method to create an arbitrary file with controlled content.

Topaz Systems SigPlus Pro ActiveX Control Version 3.95

• http://secunia.com/advisories/42800
• http://secunia.com/secunia_research/2011-1/
• http://xforce.iss.net/xforce/xfdb/65117

---

Updated on 2015-03-25