Parvez Anwar has discovered a weakness in HP PKI ActiveX control, which can be exploited by malicious people to cause a DoS (Denial of Service).

The weakness is caused due to the insecure "KillProcess()" method allowing arbitrary running user processes to be terminated by supplying the partial or full name of the process as argument. This can be exploited to terminate a specific process by supplying its name or alternatively all processes matching a supplied character or string in their name (e.g. "exe" or ".").

The weakness is confirmed in version 1.1.0.6. Other versions may also be affected.

Solution
Update to version 1.2.0.1.

Provided and/or discovered by
Parvez Anwar via Secunia

Changelog
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers