Andrea Micalizzi has discovered a vulnerability in 2X Client TuxClientSystem ActiveX Control, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the "InstallClient()" method of the TuxClientSystem ActiveX control (TuxClientSystem.dll) allowing to install an application without a user's approval. This can be exploited to install an arbitrary application by supplying a MSI package's URL to the method.

Successful exploitation allows execution of arbitrary code, but requires tricking an administrative user into viewing a malicious web page.

The vulnerability is confirmed in version 10.1 Build 1224. Other versions may also be affected.

Solution
Update to version 10.1 Build 1239.

Provided and/or discovered by
Andrea Micalizzi (rgod) via Secunia.

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers