PT-2007-3173 · Mercury · Testdirector+3

Published 2007-04-02 · Updated 2017-07-29 · CVE-2007-1819

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Mercury Quality Center versions 8.2 SP1 through 9.0 before Patch 12.1 TestDirector versions 8.2 SP1 through 9.0 before Patch 12.1

Description: The issue is a stack-based buffer overflow in the SPIDERLib.Loader ActiveX control. This allows remote attackers to execute arbitrary code via a long ProgColor property.

Recommendations: For Mercury Quality Center versions 8.2 SP1 through 9.0, apply Patch 12.1 to resolve the issue. For TestDirector versions 8.2 SP1 through 9.0, apply Patch 12.1 to resolve the issue. As a temporary workaround, consider restricting access to the Spider90.ocx ActiveX control until a patch is applied.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-1819

Affected Products

Hp Mercury Quality Center

Spiderlib.Loader Activex Control

Spider90.Ocx

Testdirector

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/hpmqc_progcolor.rb · Exploit
• 🔥 https://exploit-db.com/exploits/3661 · Exploit
• 🔥 https://exploit-db.com/exploits/16580 · Exploit
• http://vupen.com/english/advisories/2007/1185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1819 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00901872 · Vendor Advisory
• http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/cf109e434c7765eac22572a4006c6e94?OpenDocument · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33353 · Note
• http://kb.cert.org/vuls/id/589097 · Note
• http://secunia.com/advisories/24692 · Note
• http://securityfocus.com/bid/23239 · Note
• http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/7a0f7f0efc7905fdc225729f004cf387?OpenDocument · Note
• http://securitytracker.com/id?1017835 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=497 · Note