PT-2009-4057 · Lateral Arts · Lateral Arts Photobox Uploader Activex Control

Published 2009-12-03 · Updated 2018-10-10 · CVE-2009-1567

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Lateral Arts Photobox uploader ActiveX control versions 1.x through 1.2 Lateral Arts Photobox uploader ActiveX control version 2.2.0.6

Description: The issue is related to multiple stack-based buffer overflows in the Lateral Arts Photobox uploader ActiveX control. Remote attackers can execute arbitrary code via a long URL string for certain property values, including LogURL, ConnectURL, SkinURL, AlbumCreateURL, ErrorURL, or httpsinglehost.

Recommendations: For Lateral Arts Photobox uploader ActiveX control versions 1.x through 1.2, update to version 1.3 or later. For Lateral Arts Photobox uploader ActiveX control version 2.2.0.6, consider disabling the ActiveX control until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-1567

Affected Products

Lateral Arts Photobox Uploader Activex Control

References · 8

• http://vupen.com/english/advisories/2009/3376 · Vendor Advisory
• http://secunia.com/advisories/37138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1567 · Security Note
• http://secunia.com/secunia_research/2009-41 · Vendor Advisory
• http://secunia.com/advisories/37492 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3377 · Note
• http://securityfocus.com/bid/37187 · Note
• http://securityfocus.com/archive/1/508169/100/0/threaded · Note