Secunia Research has discovered a vulnerability in Danske Bank Danske e-Sec Control Module ActiveX control, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in DanskeSikker.ocx within an error logging function. This can be exploited to cause a stack-based buffer overflow by passing overly long input to certain methods when the ActiveX control has been initialised in a specific manner.

Successful exploitation allows execution of arbitrary code when e.g. visiting a malicious web site.

The vulnerability is confirmed in version 3.1.0.48. Other versions may also be affected.

Solution
Microsoft has set the kill-bit via MS10-034.

Provided and/or discovered by
Carsten Eiram, Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2008-17/

Microsoft (MS10-034):
http://www.microsoft.com/technet/security/Bulletin/MS10-034.mspx

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers