full-disclosure - HP Virtual Rooms WebHPVCInstall Control Multiple Buffer Overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20080122073747.2ED8A15803C@mailserver6.hushmail.com>
Date: Tue, 22 Jan 2008 02:37:47 -0500
From: "Elazar Broad" <elazar@...hmail.com>
To: <full-disclosure@...ts.grok.org.uk>
Cc: 
Subject: HP Virtual Rooms WebHPVCInstall Control Multiple
	Buffer Overflows

Who:
Hewlett-Packard

What:
HP Virtual Rooms is a suite of online collaboration, training and 
support tools.

How:
HP uses an ActiveX control to install the Virtual Rooms client. 
Several properties including AuthenticationURL, PortalAPIURL, 
cabroot are vulnerable to a buffer overflow.

hpvirtualrooms14.dll version 1.0.0.100
HP Virtual Rooms Install
{00000014-9593-4264-8B29-930B3E4EDCCD}
Implements IObjectSafety

Workaround:
It appears that this control is only used during the installation 
process on the Virtual Rooms client. Set the killbit for this 
control, see http://support.microsoft.com/kb/240797.

Fix:
None

Elazar

--
Discount Online Trading - Click Now!
http://tagline.hushmail.com/fc/Ioyw6h4dPYx7ZmCQyHvyhhKXQYuaLsrMOTxQzc4Yz437yYvD3WgHIM/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/