Secunia

shinnai has discovered some vulnerabilities in Data Dynamics ActiveBar, which can be exploited by malicious people to overwrite arbitrary files.

The vulnerabilities are caused due to the ActiveX control (actbar.ocx/Actbar2.ocx/Actbar3.ocx) providing the insecure "Save()", "SaveLayoutChanges()", and "SaveMenuUsageData()" methods. These can be exploited to overwrite and corrupt arbitrary files on the system in the context of the currently logged-on user.

The vulnerabilities are confirmed in versions 1.0.6.5, 2.5.0.65, 3.1.0.156, and 3.2.0.174. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
shinnai

Information about versions 1.x and 2.x being affected provided by Parvez Anwar.

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/5395
http://milw0rm.com/exploits/4190

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area