1. Symantec/
  2. Security Response/
  3. Attack Signatures/
  4. Web Attack: WibuKey Runtime ActiveX Control BO

Web Attack: WibuKey Runtime ActiveX Control BO

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Description

This signature attempts to detect a stack buffer overflow vulnerability in WibuKey Runtime ActiveX Control which may lead to execution of arbitrary code.

Additional Information

WibuKey is an application for cryptography.

The application is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input through an overly long string passed as the parameter to the method. Specifically, this issue occurs within the 'WkWin32.dll' module when processing the 'DisplayMessageDialog()' method.

Attackers can exploit this issue to execute arbitrary code within the context of an application (typically Internet Explorer) that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service condition.

Affected

  • WibuKey 6.00f Build 140 is vulnerable; other versions may also be affected.

Additional References

  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube