Honeywell HMIWeb Browser ActiveX Control RequestDSPLoad Remote Code Execution VulnerabilityZDI-12-203: December 21st, 2012
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 11490. For further product information on the TippingPoint IPS:
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Honeywell HMIWeb. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the ActiveX control defined within the HSCDSPRenderDll.dll file. The RequestDSPLoad method does not properly verify the length of a supplied argument before copying it into a fixed-length heap buffer. A remote attacker can abuse this to execute arbitrary code under the context of the user running the browser.
Vendor ResponseHoneywell states:
2011-11-23 - Vulnerability reported to vendor
2012-12-21 - Coordinated public release of advisory
CreditThis vulnerability was discovered by: