CVE ID | |
CVSS SCORE | 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P |
AFFECTED VENDORS |
Samsung |
AFFECTED PRODUCTS |
XNS ActiveX SDK |
TREND MICRO CUSTOMER PROTECTION | Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['16921']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com |
VULNERABILITY DETAILS |
The specific flaw exists within multiple methods in the XnsSdkDevice control. The control suffers from untrusted pointer dereference vulnerabilities because it blindly dereferences attacker-supplied memory addresses. An attacker can exploit this condition to achieve code execution under the context of the browser process. |
ADDITIONAL DETAILS |
02/02/2015 - ZDI sent the case to their known vendor contact -- Mitigation: The killbit can be set on this control to disable scripting within Internet Explorer by modifying the data value of the Compatibility Flags DWORD within the following location in the registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\9BED9251-E8E7-4B67-B281-ADC06BA7988D If the Compatibility Flags value is set to 0x00000400, the control can no longer be instantiated inside the browser.
|
DISCLOSURE TIMELINE |
|
CREDIT | Carlo Di Dato (aka shinnai) |