Actu
Vigil@nce - Dell OpenManage IT Assistant: information disclosure via detectIESettingsForITA.OCX
August 2011 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can invite the victim to display a malicious HTML
page, calling the Dell OpenManage IT Assistant ActiveX, in order
to read the content of the registry.
Severity: 2/4
Creation date: 18/07/2011
IMPACTED PRODUCTS
– Dell OpenManage System Management
DESCRIPTION OF THE VULNERABILITY
The Dell OpenManage IT Assistant product installs the
detectIESettingsForITA.ocx ActiveX, which detects the
configuration for Internet Explorer.
This ActiveX reads Dell hives of the registry. However, an
attacker can choose the name of the hive to read, in order to read
other values.
An attacker can therefore invite the victim to display a malicious
HTML page, calling the Dell OpenManage IT Assistant ActiveX, in
order to read the content of the registry.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
