shinnai has discovered a vulnerability in LEADTOOLS LEAD Raster Thumbnail Object Library ActiveX control, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the LEAD Raster Thumbnail Object Library (LTRTM14e.DLL) ActiveX control when handling the "BrowseDir()" method. This can be exploited to cause a stack-based buffer overflow via an overly long argument passed to the affected method.

Successful exploitation allows execution of arbitrary code when a user visits a malicious web site.

The vulnerability is confirmed in version 14.5.0.44. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
shinnai

Original Advisory
http://moaxb.blogspot.com/2007/05/moaxb-20-leadtools-raster-thumbnail.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers