1. Symantec/
  2. Security Response/
  3. Attack Signatures/
  4. HTTP IBM Lenevo ActiveX Code Exec

HTTP IBM Lenevo ActiveX Code Exec

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Description

This signature detects an attempt to execute remote code by passing data into a method of the Lenovo Inline Automated Solutions ActiveX control.

Additional Information

Lenovo Inline Automated Solutions ActiveX controls are prone to multiple vulnerabilities. These issues occurs in the ActiveX controls with CLISDs:

76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29
E598AC61-4C6F-4F4D-877F-FAC49CA91FA3

The following specific issues were reported in the 'acpRunner' control:
- A remote format-string vulnerability that may allow remote attackers to execute arbitrary code.
- The control allows arbitrary sites to access methods, which may result in a variety of attacks.
- The control doesn't verify signatures of downloaded packages, which could result in the execution of arbitrary malicious code.

An attacker may exploit these issues by enticing victims into opening a maliciously crafted HTML document.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts may result in denial-of-service conditions.

These issues affects versions prior to 'acpcontroller.dll' ActiveX control 1.2.8.0 and 'acpir.dll' ActiveX control 1.0.0.9.

Affected

  • Lenovo Inline Automated Solutions fix pack 1

Response

The vendor released updates to address these issues. Please see the references for more information.
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube