Description
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an "uninitialized pointer."
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.exploit-db.com/exploits/18674 ↗
- http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/intrust_annotatex_add.rb ↗
- http://osvdb.org/80662 ↗
- http://packetstormsecurity.org/files/111853/Quest-InTrust-Annotation-Objects-Uninitialized-Pointer.html ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74448 ↗
- http://archives.neohapsis.com/archives/bugtraq/2012-03/0153.html ↗
- http://www.securityfocus.com/bid/52765 ↗
- http://secunia.com/advisories/48566 ↗
- http://packetstormsecurity.org/files/111312/Quest-InTrust-10.4.x-Annotation-Objects-Code-Execution.html ↗