Advisory Details

May 29th, 2013

IBM SPSS Chart2D olch2x32.ocx ActiveX Remote Code Execution Vulnerability

ZDI-13-092
ZDI-CAN-1576

CVE ID CVE-2013-0593
CVSS SCORE 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
AFFECTED VENDORS IBM
AFFECTED PRODUCTS SPSS
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['12941']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM SPSS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the olch2x32.ocx ActiveX control. This object uses the Load() method to load a 2D chart into the browser. When parsing an OC2 file, the code trusts a value at a certain offset. An attacker can alter this value to control the arithmetic done on this value which can result in a user controlled pointer. An attacker can leverage this vulnerability to execute code under the context of the process.
ADDITIONAL DETAILS


http://www-01.ibm.com/support/docview.wss?uid=swg21635503
DISCLOSURE TIMELINE
  • 2013-03-22 - Vulnerability reported to vendor
  • 2013-05-29 - Coordinated public release of advisory
CREDIT rgod
BACK TO ADVISORIES