PT-2012-1405 · Viscom · Imageviewer2.Ocx+2

Dr_Ide · Published 2012-08-31 · Updated 2017-08-29 · CVE-2010-5193

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Viscom Image Viewer CP Pro version 8.0 Viscom Image Viewer Gold version 6.0

Description The issue is a stack-based buffer overflow in the TIFMergeMultiFiles function, located in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx). This allows remote attackers to execute arbitrary code via a long strDelimit parameter.

Recommendations For Viscom Image Viewer CP Pro version 8.0, consider disabling the TIFMergeMultiFiles function until a patch is available. For Viscom Image Viewer Gold version 6.0, restrict access to the SCRIBBLE.ScribbleCtrl.1 ActiveX control to minimize the risk of exploitation. Avoid using the strDelimit parameter in the affected ActiveX control until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-5193

Affected Products

Imageviewer2.Ocx

Viscom Image Viewer Cp Pro

Viscom Image Viewer Gold

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb · Exploit
• 🔥 https://exploit-db.com/exploits/15668 · Exploit
• 🔥 http://exploit-db.com/exploits/18123 · Exploit
• 🔥 https://exploit-db.com/exploits/18123 · Exploit
• 🔥 http://exploit-db.com/exploits/15668 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-5193 · Security Note
• http://secunia.com/advisories/42445 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63666 · Note