vendor:
Anzio Web Print Object
by:
Francisco Falcon
7.5
CVSS
HIGH
Buffer overflow
119
CWE
Product Name: Anzio Web Print Object
Affected Version From: Anzio Web Print Object 3.2.19
Affected Version To: Anzio Web Print Object 3.2.24
Patch Exists: Yes
Related CWE: CVE-2008-3480
CPE: anzio.com/anzio_web_print_object
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2008
Anzio Web Print Object Buffer Overflow
Anzio Web Print Object (WePO) is a Windows ActiveX web page component that, when placed on a web page can 'push' a print job from a file or web server to a user's local printer without having to display the HTML equivalent to that user. By placing WePO code on a web page, you can provide a method whereby the viewer of that web page can request a local print of a host resident print job, archived print job or a report stream through a server-side script request. Anzio Web Print Object is vulnerable to a buffer overflow attack, which can be exploited by remote attackers to execute arbitrary code, by providing a malicious web page with a long 'mainurl' parameter for the WePO ActiveX component.
Mitigation:
Update to Anzio Web Print Object 3.2.30, available at http://www.anzio.com/download-wepo.htm, or visit the vendor homepage at http://www.anzio.com.