shinnai has discovered some vulnerabilities in Zenturi ProgramChecker, which can be exploited by malicious people to overwrite or delete arbitrary files or compromise a user's system.

The vulnerabilities are caused due to the Zenturi ProgramChecker ActiveX Components (sasatl.dll) ActiveX control including the following insecure methods:

1) The "DownloadFile()" method allows a website to download a file from an arbitrary URL into an arbitrary location on a user's system. This can be exploited to e.g. place a malicious application into a user's startup folder.

2) The "NavigateUrl()" method allows a website to execute an arbitrary program on a user's system, which when combined with #1 can be exploited to e.g download and execute a malicious file.

3) The "DeleteItem()" and "QuarantineItem()" methods allows a website to delete an arbitrary file on the system in the context of the currently logged-on user.

The vulnerabilities are confirmed in version 1.5.0.531. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
shinnai

Changelog
Further details available in Customer Area

Original Advisory
http://moaxb.blogspot.com/2007/05/moaxb-30-zenturi-programchecker-activex.html
http://milw0rm.com/exploits/4049
http://milw0rm.com/exploits/4050

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area