Core Security Technologies has reported a vulnerability in the Anzio Web Print Object (WePO) ActiveX component, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when processing the "mainurl" parameter. This can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into visiting a malicious website.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in Anzio Web Print Object 3.2.19 and 3.2.24, Anzio Print Wizard Server Edition 3.2.19, and Anzio Print Wizard Personal Edition 3.2.19. Other versions may also be affected.

Solution
Update to Anzio Web Print Object 3.2.30.
Further details available to Secunia VIM customers

Provided and/or discovered by
Francisco Falcon, Core Security Technologies

Original Advisory
Anzio Print Wizard Release Notes:
http://www.anzio.com/news/newpw.htm#Release

Core Security Technologies:
http://www.coresecurity.com/content/anzio-web-print-object-buffer-overflow

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers