ActiveX control vulnerable in VeriSign's Managed PKI

A number of components in VeriSign's Managed PKI (MPKI, formerly OnSite) for the management of certificates may be vulnerable to remote attacks. According to security service provider iDefense, the security hole stems from a buffer overflow in the ActiveX control ConfigChk, which can be exploited to inject arbitrary malicious code when Internet Explorer is pointed to manipulated web sites. The control is part of client-side GoSecure and SecureMessaging installations as well as Processing Center (PC) Remote Hosting kits.

In its own advisory, VeriSign has confirmed the problem. The vendor is providing patches for Managed PKI 6.0, 6.1.3, and 7.0 that allegedly also work with Managed PKI 5.x and the older OnSite 4.6.1. VeriSign recommends that everyone who owns its MPKI and Processing Center solutions update the affected infrastructure and inform their own customers about the update. VeriSign did not, however, comment on iDefense's proposed workaround of disabling ConfigChk with a kill bit, presumably because the ActiveX control performs a crucial function for the management of public keys on client computers.

References:

• Managed PKI Client Security Vulnerability Patch, VeriSign's advisory
• VeriSign ConfigChk ActiveX Control Buffer Overflow Vulnerability, iDefense's advisory

(ehe)