Brian Dowling has reported a vulnerability in FlexNET Connect, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the client retrieving and executing script code ("rules") from update servers in an insecure manner, which can be exploited to execute arbitrary code when a client checks for updates. This check can e.g. be triggered via the FLEXnet Connect ActiveX control when a user visits a specially crafted web page.

Successful exploitation requires e.g. a MitM (Man-in-the-Middle) or DNS spoofing attack.

This vulnerability is reported in Acresso FlexNET Connect, Macrovision FlexNET Connect, and InstallShield Update Service.

Solution
Disable the update service to prevent receiving update rules.

Provided and/or discovered by
Brian Dowling, Simplicity Communications

Original Advisory
Simplicity Communications:
http://www.simplicity.net/vuln/CVE-2008-1093.txt

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers