Original URL: http://www.channelregister.co.uk/2008/01/22/hp_virtual_rooms_security_bug/
A security researcher has uncovered a serious security bug in a Hewlett-Packard website used to host virtual meetings that could allow an attacker to remotely run malicious code on the machines of people who use the service.
The vulnerability in HP Virtual Rooms (http://h10076.www1.hp.com/education/hpvr/) resides in the ActiveX client used to install the service on users' PCs, according to this advisory (http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059837.html) posted Tuesday on the Full-Disclosure mail list. Vulnerability tracking service Secunia rates it "highly critical," because it can be used by attackers to compromise a user's machine.
Over the past year, security slip-ups at HP have put its laptop customers at risk for at least three attacks. Two of them allowed attackers to remotely run malicious code if they could lure victims to a booby-trapped website. A third bug allowed miscreants to render the machine unbootable. The flaws, which HP has since fixed, resided in software that comes pre-installed on machines and is typically used to help users install updates and trouble shoot technical problems.
HP Virtual Rooms is a package of online tools for business collaboration, training and support. Participants can enter rooms to discuss particular projects and collaborate in real-time with colleagues on spreadsheets, video presentations and other jobs.
The bug in HP Virtual Rooms is found in hpvirtualrooms14.dll, which is used to install software needed to make the service work on an end-user's machine. It is likely used only during the installation process, so one possible work-around involves setting the killbit (http://support.microsoft.com/kb/240797) for the control.
The bug was reported by Elazar Broad. ®
Security bug in HP support app aids hackers (4 June 2008)
http://www.channelregister.co.uk/2008/06/04/hp_support_app_multiple_vulns/
Exploit for 'extremely critical' Yahoo Jukebox vuln goes wild (5 February 2008)
http://www.channelregister.co.uk/2008/02/05/yahoo_jukebox_vuln/
HP and Deutsche Post seal outsourcing deal (25 January 2008)
http://www.channelregister.co.uk/2008/01/25/hp_services_deutsche_post_letter/
HP to, like, totally buy Exstream Software (22 January 2008)
http://www.channelregister.co.uk/2008/01/22/hp_buys_exstream_software/
Click here to turn your HP laptop into a brick (21 December 2007)
http://www.channelregister.co.uk/2007/12/21/hp_laptop_brick_exploit/
Hey, HP laptop owners: click here to get hijacked (12 December 2007)
http://www.channelregister.co.uk/2007/12/12/hp_laptop_vuln/
Rogue ActiveX controls menace users (24 October 2007)
http://www.channelregister.co.uk/2007/10/24/activex_vulns/
HP buys web security firm SPI (19 June 2007)
http://www.channelregister.co.uk/2007/06/19/hewlett_packard_buys_spi/
So who sent you that spam? HP or Oracle? (28 March 2007)
http://www.channelregister.co.uk/2007/03/28/bots_in_perimeter/
© Copyright 2008