activePDF WebGrabber ActiveX Control Buffer Overflow
Vulnerability Description
activePDF WebGrabber version 3.8.2.0 contains a stack-based buffer overflow vulnerability in the GetStatus() method of the APWebGrb.ocx ActiveX control. By passing an overly long string to this method, a remote attacker can execute arbitrary code in the context of the vulnerable process. Although the control is not marked safe for scripting, exploitation is possible via crafted HTML content in Internet Explorer under permissive security settings.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-20001
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- MC
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/activepdf_webgrabber.rb
- https://www.exploit-db.com/exploits/16635
- https://web.archive.org/web/20081219180353/http://www.activepdf.com/products/serverproducts/webgrabber/
- https://support.activepdf.com/support/solutions/35000139131
- https://documentation.activepdf.com/WebGrabber_GS/b_installation/New_Installation.html
- https://www.vulncheck.com/advisories/activepdf-webgrabber-activex-control-buffer-overflow
Affected Vendor
activePDF
View all reports →