HP Software Update HPRulesEngine.ContentCollection ActiveX (RulesEngine.dll) Multiple Insecure Methods
High Nessus Plugin ID 29747
SynopsisThe remote Windows host has an ActiveX control that allows reading and writing of arbitrary files.
DescriptionThe remote host contains the HP Software Update software, installed by default on many HP notebooks to support automatic software updates and vulnerability patching.
The version of this software on the remote host includes an ActiveX control, 'RulesEngineLib', that reportedly contains two insecure methods - 'LoadDataFromFile()' and 'SaveToFile()' - that are marked as 'Safe for Scripting' and allow for reading and overwriting arbitrary files on the affected system. If a remote attacker can trick a user on the affected host into visiting a specially crafted web page, this issue could be leveraged to effectively destroy arbitrary files on the remote host, potentially even files that are vital for its operation, or to read the contents of arbitrary files.
SolutionEither use HP Software Update itself to update the software or disable use of this ActiveX control from within Internet Explorer by setting its kill bit.