29 August 2007, 12:02

Buffer overflow in Oracle's JInitiator ActiveX control

US Cert has warned of a security vulnerability in Oracle's JInitiator, an application for running Oracle database applications within a web browser. According to a security bulletin from the agency, buffer overflows that can occur in an ActiveX control in JInitiator may lead to the execution of injected code.

The report states that on initialisation the affected ActiveX component, beans.ocx, copies arguments to various under-sized buffers, leading to several possible buffer overflows. The security advisory does not give any further details. Version 1.1.8.16 and possibly earlier versions are affected. The vulnerable ActiveX control is not removed when installing newer versions of JInitiator. Users and administrators should therefore either set the kill bit for the control's ClassID {9b935470-ad4a-11d5-b63e-00c04faedb18} so that Internet Explorer no longer loads it, or alternatively deactivate ActiveX support for the internet zone completely.