vendor:
Aztec ActiveX
by:
7.5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: Aztec ActiveX
Affected Version From: 4.0.0.1
Affected Version To: 4.0.0.1
Patch Exists: NO
Related CWE:
CPE: mw6:aztec_activex:4.0.0.1
Platforms Tested: Windows
Buffer Overflow Vulnerability in MW6Aztec ActiveX
The Data parameter in the MW6Aztec ActiveX COM Object is subject to a buffer overflow, leading to arbitrary code execution. By entering a string larger than 9000 characters, the attached PoC (mw6maztec.html) crashes when trying to read from address 41414141. Further investigation reveals that the value of EAX 030e20d0 is written into an arbitrary memory location, and this EAX value is pointing to the Data buffer.
Mitigation:
Update to a patched version of the MW6Aztec ActiveX COM Object.