Brian Dowling has reported a vulnerability in FlexNET Connect, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the client retrieving and executing script code ("rules") from update servers in an insecure manner, which can be exploited to execute arbitrary code when a client checks for updates. This check can e.g. be triggered via the FLEXnet Connect ActiveX control when a user visits a specially crafted web page.
Successful exploitation requires e.g. a MitM (Man-in-the-Middle) or DNS spoofing attack.
This vulnerability is reported in Acresso FlexNET Connect, Macrovision FlexNET Connect, and InstallShield Update Service.
Solution: Disable the update service to prevent receiving update rules.
Provided and/or discovered by: Brian Dowling, Simplicity Communications
Original Advisory: Simplicity Communications:
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to firstname.lastname@example.org