Secunia

Brett Moore has reported two security issues in HyperAccess, which can be exploited by malicious people to compromise a vulnerable system.

1) The problem is caused due to HyperAccess session files with the ".haw" extension being set to open without user interaction in the registry key "HKEY_CLASSES_ROOT\HAWin32\EditFlags". This can be exploited to automatically load an ".haw" file and execute arbitrary vbscript code by invoking the 'Script To Run Before Connecting' option to run a script file from a SMB or WEBDAV web share.

2) The "telnet://" handler is set to "hawin32.exe" in the registry key "HKEY_CLASSES_ROOT\telnet\shell\open\command" and accepts "/r" as a parameter in a URI. This can be exploited to execute arbitrary vbscript code by loading a script file from a SMB or WEBDAV web share.

Successful exploitation requires that the user views a malicious web page using Internet Explorer.

The security issues are reported in version 8.4. Other versions may also be affected.

Solution
Modify EditFlags in the registry and remove the telnet handler from the registry.

Provided and/or discovered by
Brett Moore

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area