shinnai has discovered some vulnerabilities in Chilkat XML ActiveX Component, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to the ChilkatUtil.CkData.1 (ChilkatUtil.dll) ActiveX control including the insecure "SaveToFile()" and "AppendBinary()" methods. These can be exploited to create arbitrary files or append data to arbitrary files on the system in the context of the currently logged-on user.

Successful exploitation allows execution of arbitrary code.

The vulnerabilities are confirmed in ChilkatUtil.dll version 3.0.3.0. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX controls.

Provided and/or discovered by
shinnai

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.shinnai.net/index.php?mod=02_Forum&group=Security&argument=Remote_performed_exploits&topic=1222166972.ff.php

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers