Check Point Advisories

EMC Captiva PixTools Distributed Imaging ActiveX Control File Creation

Vulnerability
Protection

Check Point Reference:	CPAI-2009-304
Date Published:	16 Dec 2009
Severity:	High
Last Updated:	Thursday 16 May, 2024
Source:
Protection Provided by:	Security Gateway R81, R80, R77, R75, R71, R70, R65
Who is Vulnerable?
Vulnerability Description	EMC Captiva PixTools is a suite of software developer toolkits that provides image scanning, viewing, and processing functionality. A vulnerability has been reported in EMC Captiva PixTools. The flaw is due to unrestricted access to the "SetLogFileName()" and "WriteToLog()" methods, which attackers can exploit to create or overwrite arbitrary files on a target host and potentially execute malicious code.

Protection Overview

This protection will detect and block attempts to access the vulnerable ActiveX controls via HTTP.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R81 / R80 / R77 / R75 / R71 / R70 / R65

In the IPS tab, click Protections and find the EMC Captiva PixTools Distributed Imaging ActiveX Control File Creation protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Web Client Enforcement Violation.
Attack Information: EMC Captiva PixTools Distributed Imaging ActiveX Control File Creation