COMMAND
ActiveX
SYSTEMS AFFECTED
Compaq Presidio Win ME
PROBLEM
Following is based on a SSRT0716 Security Advisory. Compaq
continues to take a serious approach to the quality and security
of all its software products and makes every effort to address
issues and provide solutions in a timely manner. In line with
this commitment, Compaq is responding to recent concerns of a
potential security vulnerability with Active X.
Compaq Presario personal computers provide customer support
features through its Knowledge Center and Back web components.
Some features are implemented with Microsoft's Active X. By
utilizing the active X control function, "LogDataListToFile", an
attacking web page could write a specified file to the system's
hard drive. This allows a potential denial of service
vulnerability. The content of the file written is not modifiable.
The named file contains text with hardware and software
configuration information.
Models affected:
Laptop Models: 1200T, 1200-XL102, 1200-XL104, 1200-XL105,
1200-XL106, 1200-XL107, 1200-XL110, 1200-XL111, 1200-XL118,
1200-XL119, 1200-XL450, 1244, 1245, 1247, 1255, 1256, 1260, 1266,
1267, 1270, 1272, 1273, 1274, 1275, 1277, 1278, 12XL125, 12XL126,
12XL127, 12XL128, 12XL300, 12XL300B, 12XL310, 12XL325, 12XL326,
12XL327, 12XL330, 12XL400, 12XL401, 12XL410, 12XL426, 12XL427,
12XL430, 12XL500, 12XL501, 12XL505, 12XL510, 12XL526, 12XL527,
12XL530, 1400T EB2 (14XL3EB), 1400T-XL4, 14XL240, 14XL244,
14XL245, 14XL340, 14XL345, 14XL420, 14XL440, 14XL445, 1660, 1670,
1672, 1675, 1685, 1687, 1688, 1690, 1692, 1693, 1694, 1800, 1825,
1827, 1830, 1700T-XL5, 17XL260, 17XL262, 17XL265, 17XL275,
17XL360, 17XL365, 17XL375, 17XL460, 17XL465, 17XL475, 17XL570,
17XL575, 1800T, 1800T-XL4, 1800-XL180, 1800-XL181, 18XL2 CTO,
18XL280, 18XL380, 18XL390, 18XL580, 1900-XL1, 1900-XL161, 1920,
1925, 1930
Desktops Models: 305, 2281, 2286, 3550, 5000A Carepanion, 5000T,
5000US, 5000Z (5UVM21), 5000Z / 5007H, 5000Z / 5008H, 5001CL,
5001R, 5001SR, 5002US, 5003R, 5003US, 5004CL, 5004US, 5005CL,
5005R, 5005SR, 5006H, 5006US, 5007R, 5007SR, 5008US, 5009CL,
5009R, 5009SR, 5010US, 5011CL, 5011R, 5012US, 5014US, 5070, 5184,
5185, 5202, 5204, 5220, 5222, 5225, 5240, 5242, 5245, 5280, 5282,
5284, 5285, 5301, 5304, 5330, 5340, 5345, 5352, 5360, 5365, 5410,
5440, 5451, 5457, 5460, 5461, 5465, 5473, 5600, 5670, 5686, 5690,
5695, 5697, 5710, 5711, 5712, 5714, 5715, 5716, 5717, 5721, 5722,
5724, 5725, 5726, 5735, 5736, 5738, 5745, 5822, 5832, 5837, 5838,
5855, 5861, 5868, 5875, 5888, 5600I, 5600Kiosk, 5600S, 5700n,
5900z, 5BW112, 5BW120, 5BW122, 5BW130, 5BW131, 5BW135, 5BW160,
5BW172, 5BW175, 5BW220, 5BW250, 5BW251, 5BW284, 5WV232, 5WV252,
5WV254, 5WV260, 5WV261, 5WV270, 5WV271, 5WV275, 5WV280, 5WV282,
5WV285, 5WV294, 5WV295, 7360, 7462, 7465, 7470, 7471, 7475, 7478,
7485, 7585, 7588, 7590, 7594, 7595, 7596, 7598, 7599, 7885, 7895,
7922, 7947, 7970, 7985, 7990, 7994, 7000T (7RPM), 7000US,
7000z-7PL2, 7001CL, 7002US, 7003US, 7006US, 7AP134, 7AP135,
7AP140, 7AP170, 7AP195, 7PL270, 7PL290, 7PL295, 7QSM, 800T-80XL4,
80XL550, EZ2200, EZ2207, EZ2605, EZ2700.
SOLUTION
Compaq has changed the way the Microsoft Active X features are
used in Presario systems. A software patch is available via the
Internet as SoftPaq 17398 that solves this problem.
Apply the SoftPaq 17398 patch to Presario Systems:
http://web14.compaq.com/falco/sp_syn.asp?page=splist&detail=yes&recid=17398