← Advisories

LEADTOOLS ActiveX Common Dialogs 16.5 Multiple Remote Vulnerabilities

High
Advisory ID
ZSL-2010-4961
Release Date
01 September 2010
Vendor
LEAD Technologies, Inc. - http://www.leadtools.com
Affected Version
16.5.0.2
CVE
N/A
Tested On
Microsoft Windows XP Professional SP3 (EN), Windows Internet Explorer 8.0.6001.18702, RFgen Mobile Development Studio 4.0.0.06 (Enterprise)
Summary

With LEADTOOLS you can control any scanner, digital camera or capture card that has a TWAIN (32 and 64 bit) device driver. High-level acquisition support is included for ease of use while low-level functionality is provided for flexibility and control in even the most demanding scanning applications.

Description

LEADTOOLS ActiveX Common Dialogs suffers from multiple remote vulnerabilities (IoF, BoF, DoS) as it fails to sanitize the input in different objects included in the Common Dialogs class.

Vulnerable Objects/OCX Dialogs (Win32): 1. ActiveX Common Dialogs (Web) --------------------> LtocxWebDlgu.dll 2. ActiveX Common Dialogs (Effects) ----------------> LtocxEfxDlgu.dll 3. ActiveX Common Dialogs (Image) ------------------> LtocxImgDlgu.dll 4. ActiveX Common Dialogs (Image Effects) ----------> LtocxImgEfxDlgu.dll 5. ActiveX Common Dialogs (Image Document)----------> LtocxImgDocDlgu.dll 6. ActiveX Common Dialogs (Color) ------------------> LtocxClrDlgu.dll 7. ActiveX Common Dialogs (File) -------------------> LtocxFileDlgu.dll
Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
01.09.2010Initial release
02.09.2010Added reference [2]
05.09.2010Added reference [3]
10.09.2010Added reference [4]
15.10.2010Added reference [5]
26.10.2010Added reference [6]