Secunia

Will Dormann has reported some vulnerabilities in the British Telecommunications Consumer webhelper and Business Connect ActiveX controls, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to multiple, unspecified boundary errors within the British Telecommunications Consumer webhelper ActiveX control (btwebcontrol.dll) and the British Telecommunications Business Connect webhelper ActiveX control (btbconnectwebcontrol.dll). These can be exploited to cause buffer overflows when a user visits a malicious website.

Successful exploitation may allow execution of arbitrary code.

Solution
Update to Consumer webhelper ActiveX control version 2.0.0.8 or Business Connect webhelper ActiveX control version 1.0.0.7.

Provided and/or discovered by
Will Dormann, CERT/CC

Changelog
Further details available in Customer Area

Original Advisory
US-CERT VU#210257:
http://www.kb.cert.org/vuls/id/210257

US-CERT VU#686249:
http://www.kb.cert.org/vuls/id/686249

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area