Brett Moore has reported a vulnerability in WebArchiveX, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the ActiveX control supporting some insecure methods and is marked "safe for scripting". This can be exploited to execute arbitrary commands during system startup by writing a ".MHT" file into the user's startup folder using the "MakeArchive()" API method. It is also a possible to read arbitrary files using the "MakeArchiveStr()" method.

Successful exploitation requires that the user is e.g. tricked into visiting a malicious web site.

The vulnerability has been reported in version 5.5.0.76 installed prior to 2005-09-06.

Solution
Version 5.5.0.76 installed on 2005-09-06 and later will not have the ActiveX control marked as "safe for scripting".
Further details available to Secunia VIM customers

Provided and/or discovered by
Brett Moore, Security-Assessment.com.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.security-assessment.com/Advisories/WebArchiveX_-_Unsafe_Methods_Vulnerability.pdf

Deep Links
Links available to Secunia VIM customers