The United States Computer Emergency Readiness Team (US-CERT) reported critical security vulnerabilities in two ActiveX controls and a Netscape plug-in that InstallShield/Macrovision products install on end user machines. According to the reports the vulnerabilities can be exploited execute arbitrary code if the victim views a specially crafted HTML document, e.g. a web page or an HTML e-mail.
The affected products are:
FLEXnet Connect / InstallShield Update Service
The InstallShield Update Service Web Agent ActiveX control contains a buffer overflow, which could allow an attacker to execute arbitrary code on a vulnerable system. InstallShield Update Service is now called FLEXnet Connect.
US-CERT Report
Macrovision has released a patch to solve this problem based on version 6.0 of the FLEXnet Connect Windows agent. This does not affect the Java agent. It is recommended that you deploy this patch as soon as possible to your customer base. An e-mail with instructions has been sent to FLEXnet Connect customers.
Alternatively you can set the kill bit for the affected ActiveX control as described in the US-CERT report.
InstallFromTheWeb (IFTW)
The InstallShield InstallFromTheWeb ActiveX control and Netscape plug-in both contain multiple buffer overflows, which could allow an attacker to execute arbitrary code on a vulnerable system.
US-CERT Report
Macrovision sent me the following reply when I asked them for a comment on the IFTW vulnerability:
Regarding InstallFromTheWeb, our position is that InstallFromTheWeb is an obsolete product from Macrovision. This product has already passed it's end-of-life period, therefore Macrovision is no longer supporting this product.
We recommend, where it makes sense, that all IFTW customers use the current version of InstallShield, InstallShield 12, instead of InstallFromTheWeb. InstallShield 12 does not have the vulnerability issue.
InstallFromTheWeb was sold as a product from 1997 through early 2000, when it was replaced by One-Click Installs (OCI) in InstallShield Professional 6.2.
The workaround for the IFTW vulnerability is setting the kill bit for the affected ActiveX control, or deleting the Netscape plug-in, respectively, as described in the US-CERT report.