Novell exteNd Director LocalExec ActiveX (LocalExec.ocx) launch() Method Arbitrary Command Execution
High Nessus Plugin ID 25524
SynopsisThe remote Windows host has an ActiveX control that allows execution of arbitrary commands.
DescriptionThe remote host contains the LocalExec ActiveX control from Novell exteND Director, a set of development tools for creating enterprise web applications.
The version of this control on the remote host reportedly contains a method named 'launch()' that can be used to execute arbitrary commands. If an attacker can trick a user on the affected host into visiting a specially crafted web page, these issues could be leveraged to execute arbitrary code on the host subject to the user's privileges.
SolutionDisable the use of this ActiveX control from within Internet Explorer by setting its kill bit.