‘Critical’ ActiveX Flaws Haunt Adobe Designer

The United States Computer Emergency Readiness Team has issued a warning for multiple ActiveX buffer overflow vulnerabilities affecting Adobe’s Form Designer and Advanced Form Client software products.
The flaws, rated “highly critical” by Secunia, could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
A malicious attacker could use specially rigged HTML documents like Web pages, e-mail messages and attachments to exploit the vulnerability, US-CERT warned.
At the core of this security hiccup is the fact that Adobe Form Designer and Advanced Form Client software use ActiveX controls to allow interaction with Microsoft’s Internet Explorer browser.
According to Will Dormann, the vulnerability researcher credited with finding and reporting the issue, the flaws exist in the Adobe File Dialog Button Control (FileDlg.dll) and the Adobe Copy to Server Object (SvrCopy.dll).
A separate security bulletin from Adobe confirmed the high-risk nature of the issue urged all users of Form Designer 5.0 or Form Client 5.0 to apply patches that are now available.
“A malicious HTML file must be loaded in the Web browser by the end user for an attacker to exploit these vulnerabilities,” Adobe said.
ActiveX vulnerabilities have popped up recently in several widely deployed products, including image uploading software used by Facebook and MySpace and RealNetworks’ flagship RealPlayer software.
The U.S. CERT recommends disabling ActiveX controls from running by default.