Skip to main content

Security Alert: IBM SPSS About/Licensing: Vulnerable issue in SetLicenseInfoEx() method exposed by the mraboutb.dll ActiveX Control.


Flash (Alert)


Abstract

The security issue was originally published as a high security vulnerability and based on our ongoing technical assessment we have reduced the severity to medium. The vulnerability is in the mrabout.dll Active X control for Data Collections products. The products/versions that are affected are listed below and fixes are available below.

Content

Products Affected:

Dimensions 5.5
Data Collection 5.6 and 6.0

Description:

ZDI-CAN-1295: IBM SPSS Vulnerable issue in SetLicenseInfoEx() method exposed by the mraboutb.dll ActiveX Control.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM SPSS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within SetLicenseInfoEx() method exposed by the mraboutb.dll ActiveX Control. String data supplied to the first parameter (strInstallDir) of SetLicenseInfoEx() is copied into a 256 byte global buffer without first checking the string length. This overflow can be exploited to remotely execute arbitrary code on the target system.
Based on additional technical assessment of this security issue, IBM has lowered the base severity rating from high, as originally reported, to medium. At this time we have not identified a high risk exploitation vector for this vulnerability and we have no information indicating that there is an immediate risk of exploitation. IBM can not rule out other valid vectors and are continuing our evaluation; for this reason we have decided to inform our clients about this potential security issue and recommend that they install the appropriate fix as soon as possible.
As of 9/1/2011, IBM has not received any reports of customer issues related to this security vulnerability. The vulnerability was identified and reported to IBM by a security testing company, TippingPoint.

Solutions:

There is an IBM fixpack available for each release. The IBM product fixpacks should be implemented as soon as practical and your business needs dictate.

Affected Product/Version and Applicable Fixes:


Version
Product offering
Available fixpack or risk mitigation
5.5
Dimensions Data Model Dimensions 5.5 P7 HF7
5.6
dc Data Model Data Collection 5.6 P5 HF45
6.0
dc Data Model Data Collection 6 FixPack 2 HF10


Rate this page:

(0 users)Average rating

Copyright and trademark information

IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.

Rate this page:


(0 users)Average rating

Add comments

Document information

SPSS Data Collection

Data Model

Software version:
5.5, 5.6, 6.0

Operating system(s):
Windows

Reference #:
1514498

Modified date:
2013-01-23

Translate my page

Content navigation