ActiveX control from eBay makes Windows PCs vulnerable

US CERT has issued a warning about a critical hole in eBay's Enhanced Picture Services, with which images are uploaded to auctions. eBay provided an ActiveX control for Internet Explorer in this service. But according to the error report, attackers can use a buffer overflow in this control to load code onto local computers and execute it via the net. Victims first have to visit a prepared web site or an HTML document that exploits this hole.

US CERT explains that the Control EPUImageControl (EUPWALcontrol.dll) is included in "Sell Your Item (SYI)", "Setup & Test eBay Enhanced Picture Services" and "Picture Manager Enhanced Uploader". Their advisory explains how users can tell whether the control is on their computers: go to the menu item "Tools/Internet Options"; in the default "General" tab, click on the "Settings..." button in the "Temporary Internet files" group, and then "View Objects...". A new dialogue box shows which controls are installed. If EPUImageControl is listed there, a user may have a problem. While eBay has released a new version of the control, it is only offered as an update if the image upload service is used at eBay. Those who want to get rid of the control altogether can simply delete it.

Also see:

• eBay Enhanced Picture Services ActiveX control buffer overflow, Vulnerability Note VU#597721 at US-CERT

(ju)