HTTP: Oracle JInitiator Unsafe ActiveX Control
This signature detects attempts to exploit a known vulnerability in Oracle JInitiator. An attacker can create malicious Web pages containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.
Extended Description
Oracle JInitiator is prone to multiple remote buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. Exploiting these issues allows remote attackers to execute arbitrary code in the context of applications using the affected ActiveX control and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions. These issues affect Oracle JInitiator 1.1.8.16; other versions may also be affected.
Affected Products
Oracle jinitiator
Short Name
HTTP:STC:CLSID:ACTIVEX:JINIT-AX
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
ActiveX CVE-2007-4467 Control JInitiator Oracle Unsafe bid:25473
Release Date
09/21/2007
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3729
False Positive
Unknown
Vendors
Oracle
CVSS Score
9.3