Sukhee Jung has reported some vulnerabilities in SignKorea's SKCrypAX ActiveX control, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the "DownloadCert()", "DecryptFileByKey()", and "EncryptFileByKey()" methods. These can be exploited to cause stack-based buffer overflows via overly long strings passed as certain arguments to the said methods.

The vulnerabilities are reported in version 5.4.1.2. Other versions may also be affected.

Solution
Update to the latest version.

Provided and/or discovered by
Sukhee Jung

Changelog
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers