Macrovision FLEXnet Connect ActiveX Buffer Overflow Vulnerability (CVE-2007-0321)

Vulnerability Key Information Vulnerability Overview Vulnerability Name: Macrovision FLEXnet Connect / InstallShield Update Service Agent ActiveX buffer overflows Vulnerability ID: VU#847993 Release Date: 2007-02-22 Last Revised: 2009-04-13 Vulnerability Description Affected Component: ActiveX control for InstallShield Update Service, now known as Macrovision FLEXnet Connect Vulnerability Details: Buffer overflow vulnerabilities exist in the ActiveX control, which attackers could exploit to execute arbitrary code on vulnerable systems. Impact Potential Harm: Attackers may trick users into visiting specially crafted HTML documents, leading to arbitrary code execution under the user's privileges, and potentially causing Internet Explorer to crash. Solution Recommended Action: Apply the FLEXnet Connect 6.0 Security Patch; details available in Acesso support document Q113020. Alternative: If FLEXnet Connect SDK is installed, consider disabling the affected ActiveX control. Vendor Information Affected Vendors: IBM Corporation, Macrovision-InstallShield CVSS Metrics Base Score: Not explicitly shown Temporal Score: Not explicitly shown Environmental Score: Not explicitly shown Reference Links InstallShield Support Documentation Microsoft Support Documentation Secunia Advisory Acknowledgments Discoverer: Dan Plakosh Additional Information CVE ID: CVE-2007-0321 Severity Metric: 2.75 Last Updated: 2009-04-13 17:18 UTC

Goal Reached Thanks to every supporter — we hit 100%!

Macrovision FLEXnet Connect ActiveX Buffer Overflow Vulnerability (CVE-2007-0321)