‘Critical’ ActiveX Flaws Haunt Adobe Designer

Écrit par
Ryan Naraine
Ryan Naraine
Published: Mar 12, 2008
Updated: Feb 2, 2021
1 minute read
eWeek Le contenu et les recommandations de produits sont indépendants de la rédaction. Nous pouvons gagner de l'argent lorsque vous cliquez sur des liens vers nos partenaires. En savoir plus

The United States Computer Emergency Readiness Team has issued a warning for multiple ActiveX buffer overflow vulnerabilities affecting Adobe’s Form Designer and Advanced Form Client software products.
The flaws, rated “highly critical” by Secunia, could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
A malicious attacker could use specially rigged HTML documents like Web pages, e-mail messages and attachments to exploit the vulnerability, US-CERT warned.
At the core of this security hiccup is the fact that Adobe Form Designer and Advanced Form Client software use ActiveX controls to allow interaction with Microsoft’s Internet Explorer browser.
According to Will Dormann, the vulnerability researcher credited with finding and reporting the issue, the flaws exist in the Adobe File Dialog Button Control (FileDlg.dll) and the Adobe Copy to Server Object (SvrCopy.dll).
A separate security bulletin from Adobe confirmed the high-risk nature of the issue urged all users of Form Designer 5.0 or Form Client 5.0 to apply patches that are now available.
“A malicious HTML file must be loaded in the Web browser by the end user for an attacker to exploit these vulnerabilities,” Adobe said.
ActiveX vulnerabilities have popped up recently in several widely deployed products, including image uploading software used by Facebook and MySpace and RealNetworks’ flagship RealPlayer software.
The U.S. CERT recommends disabling ActiveX controls from running by default.

Ryan Naraine

Ryan Naraine is a ServerWatch, eSecurity Planet, and eWEEK contributor.

eWeek Logo

eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site's focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

Propriété de TechnologyAdvice. © 2026 TechnologyAdvice. Tous droits réservés

Divulgation publicitaire : Certains des produits qui apparaissent sur ce site proviennent d'entreprises dont TechnologyAdvice reçoit une compensation. Cette compensation peut influencer la façon dont les produits apparaissent sur ce site, notamment l'ordre dans lequel ils apparaissent. TechnologyAdvice n'inclut pas toutes les entreprises ou tous les types de produits disponibles sur le marché.