TestDirector (TD) for Mercury Quality Center SPIDERLib.Loader ActiveX Control (Spider90.ocx) ProgColor Property Overflow

This script is Copyright (C) 2007-2016 Tenable Network Security, Inc.


Synopsis :

The remote Windows host has an ActiveX control that is susceptible to
a buffer overflow vulnerability.

Description :

The Windows remote host contains an ActiveX control used by Mercury
Quality Center, a web-based solution for automatic software testing.

The version of this ActiveX control on the remote host reportedly
contains a buffer overflow vulnerability in its 'ProgColor' property.
By setting the property to an overly long value, a remote attacker may
be able to leverage this issue to execute arbitrary code on the remote
host subject to the privileges of the current user.

See also :

http://www.nessus.org/u?aa0d77e4
http://seclists.org/fulldisclosure/2007/Apr/66
http://www.nessus.org/u?ee538bf9
http://www.securityfocus.com/advisories/12180

Solution :

Either remove the control if Quality Center access is not needed or
apply the appropriate patch referenced in the vendor advisory above to
the Quality Control server and browse the Quality Control server's
Site Administration page to update the control on the remote host.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.7
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 24909 ()

Bugtraq ID: 23239

CVE ID: CVE-2007-1819

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now