Christian Studer 2002-08-15 00:06
A security issue has been discovered in UltraMon which could be exploited by a malicious website to run a program on the local system.
Affected versions of UltraMon: 2.0 Beta 4 - Beta 7. If you are using 2.0 RC1 you are NOT affected by this issue, and don't need to apply the patch.
To fix this vulnerability, 3 UltraMon-related registry keys need to be deleted. A script is available to do this: remove_sfs.zip. After downloading the ZIP file, extract it to a folder of your choice and run the remove_sfs.vbs file by double-clicking it. If you are using Windows 2000/XP, you'll need to be logged in as administrator in order to run the script.
If you are using anti-virus software, you may get a warning when running the script: this warning can be safely ignored.
You can also delete the registry keys manually using regedit.exe. The following keys need to be deleted (including subkeys):
HKEY_CLASSES_ROOT\CLSID\{275DB82D-B1AB-40E2-A70A-B1ACBCD81B38}\Implemented Categories
HKEY_CLASSES_ROOT\CLSID\{9E6677A4-3C7A-4136-81DD-E2A4CF433259}\Implemented Categories
HKEY_CLASSES_ROOT\CLSID\{1BC64DEE-F18D-42FF-8C10-E375F2F1E501}\Implemented Categories
Technical details:
the problem is that several COM objects used by UltraMon were marked as safe for scripting.
This means that they can be used on a web page if you are using Internet Explorer with default security settings (ActiveX objects and client-side scripting enabled).
In the worst-case scenario, this would enable a malicious website to run any application on the local system by using the Utility object's Run method.
Christian Studer - www.realtimesoft.com
|
|
