A vulnerability has been discovered in the Synactis ALL In-The-Box ActiveX control, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the All_In_The_Box.AllBox ActiveX control (All_In_The_Box.ocx) providing the insecure "SaveDoc()" method. This can be exploited to overwrite arbitrary files on the system via a filename terminated by a NULL byte.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in All_In_The_Box.ocx version 3.1.2.0. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
Digital Security Research Group

Changelog
Further details available in Customer Area

Original Advisory
http://www.dsecrg.com/pages/vul/show.php?id=62

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area