HTTP: Tom Sawyer GET Extension Factory COM Object Instantiation ActiveX

This signature detects attempts to use unsafe ActiveX controls in Tom Sawyer GET Extension Factory. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Tom Sawyer Software GET Extension Factory is prone to a remote memory-corruption vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. NOTE (June 3, 2011): This BID was previously titled 'VMware Infrastructure (VI) Client ActiveX Object Memory Corruption Vulnerability' but has been rewritten to better reflect the underlying issue.

Affected Products

Tom_sawyer_software get_extension_factory

References

BugTraq: 48099

CVE: CVE-2011-2217

URL: http://www.vmware.com/security/advisories/vmsa-2011-0009.html http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=911

Short Name

HTTP:STC:ACTIVEX:TOM-SAMYER-GET

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Tom Sawyer GET Extension Factory COM Object Instantiation ActiveX

Extended Description

Affected Products

References

Found a potential security threat?