SB2008062701 - Remote code execution in UUSee UUUpgrade.ocx ActiveX control

Description

This security bulletin contains information about 1 security vulnerability.

1) Unsafe ActiveX method (CVE-ID: CVE-2008-7168)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of arguments passed to the "Update()"  method in UUUpgrade.ocx ActiveX control. A remote attacker can trick the victim to visit a specially crafted website and upload malicious file into arbitrary location on victim's computer.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability was being actively exploited in the wild.

Remediation

Install update from vendor's website.

References

• https://www.exploit-db.com/exploits/31980/
• http://www.securityfocus.com/bid/29963/info