HTTP: Chilkat Crypt ActiveX Control 'SaveDecrypted' Insecure Method Vulnerability

This signature detects attempts to use unsafe ActiveX controls in Chillkat Crypt. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Chilkat Crypt ActiveX control is prone to a vulnerability caused by an insecure method that let attackers overwrite files with arbitrary, attacker-controlled content. Successfully exploiting this issue allows remote attackers to overwrite arbitrary files in the context of the application (typically Internet Explorer) using the ActiveX control.

Affected Products

Chilkat chilkat_crypt_activex

References

BugTraq: 48585

URL: http://www.htbridge.ch/advisory/atube_catcher_activex_control_savedecrypted_insecure_method.html http://www.chilkatsoft.com/ http://downloads.securityfocus.com/vulnerabilities/exploits/48585.html

Short Name

HTTP:STC:ACTIVEX:CHILLKAT-CRYPT

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Chilkat Crypt ActiveX Control 'SaveDecrypted' Insecure Method Vulnerability

Extended Description

Affected Products

References

Found a potential security threat?