Secunia - Stay Secure
Did you know...
Home Corporate Website Jobs Mailing Lists RSS Blog New entry Advertise
Solutions For
  Security Professionals
  Security Vendors

Free Solutions For
  Open Communities
  Journalists & Media

Software Inspectors
  Online
  Personal (PSI)
  Network (NSI)

Secunia Advisories
  Search
  Historic Advisories
  Listed By Product
  Listed By Vendor
  Statistics / Graphs
  Secunia Research
  Report Vulnerability
  About Advisories

Virus Information
  Chronological List
  Last 10 Virus Alerts
  About Virus Information

Secunia Customers
  Customer Area


Macrovision Products Update Service ActiveX Control Insecure Methods Advisory Available in Danish  Advisory Available in German 

Secunia Advisory: SA27475  
Release Date: 2007-11-01

Critical:
Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch

Software:Macrovision AdminStudio
Macrovision FLEXnet Connect 6.x
Macrovision InstallShield
Macrovision Update Service 2.x
Macrovision Update Service 3.x
Macrovision Update Service 4.x
Macrovision Update Service 5.x

CVE reference:CVE-2007-5660 (Secunia mirror)

Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS!


Description:
Some vulnerabilities have been reported in Macrovision products, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to the Update Service ActiveX control (isusweb.dll) including certain unspecified insecure methods, which can be exploited to e.g. download and execute arbitrary programs.

The vulnerability is reported in versions 5.01.100.47363 and 6.0.100.60146 of the Update Service ActiveX control. Other versions may also be affected.

Solution:
Apply updates (see vendor's advisory for details).
http://www.macrovision.com/promolanding/7660.htm

Provided and/or discovered by:
Discovered by an anonymous researcher and reported via iDefense Labs.

Original Advisory:
Macrovision:
http://www.macrovision.com/promolanding/7660.htm
http://support.installshield.com/kb/view.asp?articleid=Q113020
http://support.installshield.com/kb/view.asp?articleid=Q113602

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=618

Extended Solution:
The "Extended Solution" section is available for Secunia customers only. Request a trial and get access to the Secunia Customer Area and Extended Secunia advisories.



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

3 Related Secunia Security Advisories

1. Macrovision FLEXnet boisweb.dll ActiveX Control Buffer Overflows
2. Macrovision FLEXnet Connect DWUpdateService ActiveX Control Insecure Methods
3. Macrovision FLEXnet Connect Update Service Agent Buffer Overflow


Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.








Secunia Personal Software Inspector (BETA)

Secunia Poll

Have your organisation taken any extraordinary steps to remediate the Microsoft Windows URI vulnerability?


See Results   

Most Popular Advisories

1.
Internet Explorer Multiple Vulnerabilities
2.
Slackware update for cups
3.
Fedora update for xen
4.
Fedora update for nagios-plugins
5.
Fedora update for cups
6.
SonicWALL SSL VPN ActiveX Controls Multiple Vulnerabilities
7.
Mandriva update for xen
8.
Mandriva update for cups
9.
Blue Coat ProxySG SGOS Cross-Site Scripting Vulnerabilities
10.
Gentoo update for gftp





Vulnerability Management - Terms & Conditions - Copyright 2002-2007 Secunia - Compliance - Contact Secunia