TippingPoint Zero Day Initiative

IBM SPSS Chart2D olch2x32.ocx ActiveX Remote Code Execution Vulnerability

ZDI-13-092: May 29th, 2013


CVSS Score

Affected Vendors

Affected Products

TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 12941. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM SPSS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the olch2x32.ocx ActiveX control. This object uses the Load() method to load a 2D chart into the browser. When parsing an OC2 file, the code trusts a value at a certain offset. An attacker can alter this value to control the arithmetic done on this value which can result in a user controlled pointer. An attacker can leverage this vulnerability to execute code under the context of the process.

Vendor Response

IBM states:


Disclosure Timeline

    2013-03-22 - Vulnerability reported to vendor
    2013-05-29 - Coordinated public release of advisory


This vulnerability was discovered by: