Quest InTrust ActiveX Controls Multiple Vulnerabilities

by Carol~ Moderator - 3/30/12 1:36 PM

In Reply to: VULNERABILITIES / FIXES - March 30, 2012 by Carol~ Moderator

Release Date : 2012-03-30

Criticality level : Highly critical
Impact : System access
Manipulation of data
Where : From remote
Solution Status : Unpatched

Software:
Quest ARDoc ActiveX Control 7.x
Quest InTrust 10.x
Software FX Annotation Objects Extension ActiveX Control (AnnotateX.dll) 1.x

Description:
Andrea Micalizzi has discovered multiple vulnerabilities in Quest InTrust, which can be exploited by malicious people to manipulate certain data and compromise a user's system.

1) An insecure method in the ARDoc ActiveX Control (ARDoc.dll) can be exploited to overwrite arbitrary files with the contents of exported documents via a call to the "SaveToFile()" method with a specially crafted "bstrFileName" argument.

2) An input validation error in the Annotation Objects Extension ActiveX Control (AnnotateX.dll) can be exploited to call an arbitrary memory location via a call to the "Add()" method with a specially crafted "obj" argument.

Successful exploitation of this vulnerability allows execution of arbitrary code.

The vulnerabilities are confirmed in version 10.4.0.853. Other versions may also be affected.

Solution:
Set the kill-bit for the ActiveX controls.

Provided and/or discovered by:
Andrea Micalizzi (rgod)

Original Advisory:
http://retrogod.altervista.org/9sg_quest_ii.htm
http://retrogod.altervista.org/9sg_quest_adv.htm

http://secunia.com/advisories/48566/