Secunia

Neo and Park Gyu Tae have reported a vulnerability in LiveCall, which potentially can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the "hLDown.dll" used by the LiveCall ActiveX control failing to verify some input parameters (e.g. the URL of the update site) and the authenticity of the received live update configuration file (liveup.haz). This can potentially be exploited to download arbitrary files to a user's system via a specially crafted liveup.haz file from a malicious web site.

Successful exploitation requires that the user is tricked into visiting a malicious web site or requires a site hosting LiveCall to e.g. have some exploitable cross-site scripting vulnerabilities.

The vulnerability has been reported in versions 2004.6.25.1 and 2005.6.21.1 and was reportedly fixed in version 2005.7.14.1. However, Secunia Research has confirmed another variant of the vulnerability in this version.

Solution
Update to the latest version by visiting the vendor's LiveCall website.
Further details available in Customer Area

Provided and/or discovered by
Originally discovered by:
Neo and Park Gyu Tae

Additional research:
Tan Chew Keong, Secunia Research.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area