← Advisories

Mindjet MindManager 2012 v10.0.493 Multiple Remote Vulnerabilities

Critical
Advisory ID
ZSL-2012-5068
Release Date
31 January 2012
Vendor
Affected Version
10.0.493 (Windows)
Tested On
Microsoft Windows XP Professional SP3 (EN)
Summary

An intuitive visual framework that fosters clarity, innovative thinking & communication to improve business results.

Description

MindManager suffers from several vulnerabilities included into the whole package. Several OCX and DLL libraries from 3rd party software (glg.ocx, officeviewermme.ocx, pdfxctrl.dll, vsflex8n.ocx and ChartFX.ClientServer.Core.dll) are vulnerable to buffer overflow and denial of service (IE). Also the application is vulnerable to insecure library loading with every file extension thru ssgp.dll and dwmapi.dll.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
31.01.2012Initial release
01.02.2012Added reference [4], [5], [6] and [7]
02.02.2012Added reference [8]
24.11.2012Added reference [9]