Secunia

A vulnerability has been discovered in HP PSC All-in-One Series software/driver installer, which can be exploited by malicious people to overwrite arbitrary files or compromise a user's system.

The vulnerability is caused due to the HPQXML.XMLData.1 (hpqxml.dll) ActiveX control including the insecure "saveXMLAsFile()" and "loadXMLString()" methods. These can be exploited to e.g. overwrite and corrupt an arbitrary file on the system or load malicious script code and then save it in an arbitrary location on a user's system in the context of the currently logged-on user.

The vulnerability is confirmed in HP All-in-One Series Full Feature software/driver for HP PSC 2355 All-in-One version 4.7.0 and HP PSC 2410 All-in-One version 4.2.0, including hpqxml.dll version 4.0.0.204. Other products and versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
Originally reported as a file overwrite vulnerability via the "saveXMLAsFile()" method by Brian Mariani.

Additional information by Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
http://goodfellas.shellcode.com.ar/own/VULWAR200706275.txt

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area