Outpost 個人防火牆 - Vulnerability in JView Profiler Could Allow Remote Code Execution

Agnitum Security Advisories

ASA-01-0507-4: Vulnerability in JView Profiler Could Allow Remote Code Execution

Severity rating: Critical
Date Published: July 12, 2005
Software Vendor: Microsoft
Affected Software: JView Profiler, Internet Explorer 6.0 and below Affected OS: Windows XP, Windows Me, Windows 98 (incl. SE), Windows Server 2003, Windows 2000
Unaffected with -
Vulnerability class: Remote Code Execution
Status: Fixed

Tech brief:

Vulnerability is caused when Microsoft Internet Explorer instantiates the JView Profiler (Javaprxy.dll) COM object as an ActiveX control. This may corrupt system memory in such a way that an attacker could execute arbitrary code on an affected computer.

By constructing special insidious website and running malicious ActiveX scripts on it, an attacker can compromise the unprotected computer that uses Internet Explorer as a web browser and as a result take over the affected system.

If a user is logged on with administrative rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system - install programs; view, change, or delete data; or create new accounts with root access rights.

Vendor reference information:

Vendor details pertaining to the problem are available here:
http://www.microsoft.com/technet/security/Bulletin/MS05-037.mspx

General Mitigating Recommendations:

• Install latest vendor patches available at http://windowsupdate.microsoft.com
• Use alternate browser such as Opera or Firefox

How Outpost Firewall PRO and Outpost Office Firewall protect you:

The unconstrained running of Active X software within Microsoft Internet Explorer has long been considered the most vulnerable to exploits caveat. We recommend enabling the running of Active X software only for the trusted websites, and disabling it for the rest altogether. You can do that via Outpost's Active Content plug-in.

Disclaimer:

Information in the present advisory is believed to be accurate as to the time of publishing based on currently available information. Use of the information signifies acceptance for use in an AS IS condition. There are no warranties with regard to this information. Agnitum Ltd. doesn't accept any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

關於Version 2 Limited

Version 2 Limited 是亞洲其中一間最有活力的IT公司，公司發展及代理各種不同的互聯網及IP-Based 網絡IT產品，當中包括通訊系統、保安、網絡及媒體產品。透過公司龐大的網絡、銷售點、分銷商及合作顆伴，Version 2 Limited 便可提供廣被市場讚賞的產品及服務。Version 2 Limited 客戶來自各行各業，包括全球1000大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企及來自亞洲各城市的客戶。

如對產品有興趣，可瀏覽以下網址:
http://www.version-2.com/op
http://www.version-2.com/nod32op