[NT] HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow Vulnerability
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 4 Apr 2007 16:34:53 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow
Mercury Quality Center is "a web-based interface that allows managers to
automate software quality testing".
Remote exploitation of a buffer overflow vulnerability in an ActiveX
control installed by Hewlett-Packard Mercury Quality Center could allow
for the execution of arbitrary code.
* Hewlett-Packard Mercury Quality Center version 9.0.
* The vulnerable ActiveX control is version 126.96.36.19953.
Hewlett-Packard Mercury Quality Center installs the following ActiveX
control which is registered as safe for scripting.
File: C:\WINDOWS\Downloaded Program Files\Spider90.ocx
This control contains an exploitable stack based buffer overflow in the
"ProgColor" property. By setting this property to an overly long value, a
buffer overflow will occur.
Exploitation of this vulnerability allows for the execution of arbitrary
The target ActiveX Control is part of the Mercury Quality Center web
application which runs on port 8080 by default. Any user which can
remotely log into the web application will have to install the vulnerable
Hewlett-Packard Mercury has addressed this vulnerability by releasing
patches. For more information consult
<http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00901872> HP Document ID c00901872.
* 02/16/2007 - Initial vendor notification
* 02/16/2007 - Initial vendor response
* 04/02/2007 - Forced public disclosure
The information has been provided by iDefense.
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NEWS] Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities
- Next by Date: [NT] Microsoft Windows WMF Triggerable Kernel Design Error DoS Vulnerability
- Previous by thread: [NEWS] Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities
- Next by thread: [NT] Microsoft Windows WMF Triggerable Kernel Design Error DoS Vulnerability