Secunia

shinnai has discovered a vulnerability in Clever Internet ActiveX Suite, which can be exploited by malicious people to overwrite arbitrary files or compromise a vulnerable system.

The vulnerability is caused due to the clInetSuiteX6.clWebDav (clinetsuitex6.ocx) ActiveX control including the insecure "GetToFile()" method, which downloads and saves a file specified as arguments. This can be exploited to e.g. overwrite and corrupt arbitrary files on the system in the context of the currently logged-on user or download an arbitrary file and save it to an arbitrary location on the user's system.

The vulnerability is confirmed in version 6.2. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
shinnai

Changelog
Further details available in Customer Area

Original Advisory
http://www.shinnai.altervista.org/index.php?mod=02_Forum&group=Exploits&argument=Remote&topic=1185360444.ff.php&page=last

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area