CVE-2012-5896 The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary...
HighCVSS 10.0
EPSS 68.7%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an "uninitialized pointer."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Quest intrust | <= 10.4.0.853 | No fix listed |
| Quest intrust | = 10.1 | No fix listed |
| Quest intrust | = 10.2.5 | No fix listed |
| Quest intrust | = 10.3 | No fix listed |
| Quest intrust | = 10.4 | No fix listed |
References
- 20120328 Quest InTrust 10.4.x Annotation Objects ActiveX Control AnnotateX.dll Uninitialized Pointer Remote Code Execution exploit mailing-list
- dev.metasploit.com exploit
- 80662 vdb-entry
- packetstormsecurity.org
- packetstormsecurity.org exploit
- 48566 third-party-advisory vendor-advisory
- 18674 exploit
- 52765 exploit vdb-entry
- intrust-annotatex-code-execution(74448) vdb-entry