eEye Digital Security has reported some vulnerabilities in two IBM Access Support ActiveX controls, which potentially can be exploited by malicious people to compromise a user's system.

1) The IBM acpRunner Access Support ActiveX control includes some insecure methods ("DownLoadURL", "SaveFilePath", and "Download"), which allow a malicious web site to place a file in an arbitrary location on a user's system.

2) IBM eGatherer Access Support ActiveX control also includes some insecure methods ("GetMake", "GetModel", "GetOSName", "SetDebugging", and "RunEgatherer"), which may allow a malicious web site to place a file in an arbitrary location on a user's system.

The ActiveX controls are reportedly installed by default on many IBM PC models.

Solution
Apply Fix Pack 2 for Access Support.
Further details available in Customer Area

Provided and/or discovered by
1) http-equiv
2) Drew Copley, eEye Digital Security.

Changelog
Further details available in Customer Area

Original Advisory
http://www.eeye.com/html/research/advisories/AD20040615A.html
http://www.eeye.com/html/research/advisories/AD20040615B.html

Deep Links
Links available in Customer Area