Secunia

Some vulnerabilities have been discovered in Friendly Technologies fwDialerTechTool.dll ActiveX control, which can be exploited by malicious people to disclose sensitive information and compromise a user's system.

1) A boundary error exists within the "CreateURLShortcut()" method when handling an overly long parameter. This can be exploited to cause a buffer overflow when a user e.g. visits a malicious website.

Successful exploitation allows execution of arbitrary code.

2) The ActiveX control contains the insecure method "RunApp()", which allows launching of arbitrary applications with parameters when a user e.g. visits a malicious website.

3) The ActiveX control contains the insecure method "RegistryValue()", which allows reading and writing arbitrary registry keys when a user e.g. visits a malicious website.

The vulnerabilities are confirmed in version 3.3.3.1 of the ActiveX control as included with FriendlyPPPoE version 3.0.0.57. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
spdr

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/6323
http://milw0rm.com/exploits/6324
http://milw0rm.com/exploits/6334

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area