Oracle Siebel Option Pack for IE ActiveX Control Memory Initialization Vulnerability

Oracle Siebel Option Pack for IE ActiveX Control Memory Initialization Vulnerability

Released on: 2010-08-06
Updated on: 2010-08-09

Affected Systems:
Oracle Siebel Option Pack for IE 7.x
Description:
--------------------------------------------------------------------------------
Cve id: CVE-2009-3737

Siebel Option Pack for IE is an ActiveX control provided by Oracle Siebel CRM software.

The Siebel Option Pack for IE ActiveX control does not properly initialize the memory used by the NewBusObj () method. If a user is cheated to access a malicious webpage and calls this method with special parameters, arbitrary code may be executed.

<* Source: Will Dormann

Link: http://secunia.com/advisories/40804/
Http://www.kb.cert.org/vuls/id/174089
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:

* Save the following text as a. REG file and import it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {07070bfd-c501-4899-934d-0b96a9f70795}]
"Compatibility Flags" = dword: 00000400
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {07070bfd-c501-4899-934d-0b96a9f70795}]
"Compatibility Flags" = dword: 00000400

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {26bac093-997c-4084-bad6-c35f5d67ea99}]
"Compatibility Flags" = dword: 00000400
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {26bac093-997c-4084-bad6-c35f5d67ea99}]
"Compatibility Flags" = dword: 00000400

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {45874228-a445-40dc-962b-ec15559b1741}]
"Compatibility Flags" = dword: 00000400
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {45874228-a445-40dc-962b-ec15559b1741}]
"Compatibility Flags" = dword: 00000400

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {631f0c94-c02f-40ac-a31b-ddc000031fc81}]
"Compatibility Flags" = dword: 00000400
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {631f0c94-c02f-40ac-a31b-ddc000031fc81}]
"Compatibility Flags" = dword: 00000400

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {68cdb19a-6305-4589-8c35-41e3502cd451}]
"Compatibility Flags" = dword: 00000400
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {68cdb19a-6305-4589-8c35-41e3502cd451}]
"Compatibility Flags" = dword: 00000400

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {81a81dd2-a261-442a-b9b1-df10a2542020}]
"Compatibility Flags" = dword: 00000400
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ ActiveX Compatibility \ {81a81dd2-a261-442a-b9b1-df10a2542020}]
"Compatibility Flags" = dword: 00000400

Vendor patch:

Oracle
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.oracle.com