Francis Provencher has discovered a vulnerability in DecisionTools, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the "Images" property in the SharpGrid ActiveX control insecurely using the assigned value as an image list pointer and can be exploited to call a virtual function within an arbitrary memory location.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 5.7 (sg20u.ocx version 2.1.1.1127). Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
Francis Provencher, Protek Research Lab's via Secunia.

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers