----------------------------------------------------------------------

Secunia Network Software Inspector 2.0 (NSI) - Public Beta

The Public Beta has ended. Thanks to all that participated.

Learn more:
http://secunia.com/network_software_inspector_2/

----------------------------------------------------------------------

TITLE:
Akamai Download Manager Code Execution Vulnerability

SECUNIA ADVISORY ID:
SA30037

VERIFY ADVISORY:
http://secunia.com/advisories/30037/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

REVISION:
2.0 originally posted 2008-05-01

SOFTWARE:
Akamai Download Manager 2.x
http://secunia.com/product/13954/

DESCRIPTION:
A vulnerability has been reported in Akamai Download Manager, which
can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to certain undocumented object
parameters, which can be exploited to e.g. download and execute
malicious programs when a user is tricked into visiting a malicious
site.

The vulnerability is reported in both the ActiveX and Java versions
prior to 2.2.3.5.

SOLUTION:
Fixed in version 2.2.3.5.

NOTE: Updating the product via the vendor update page does not
properly remove the vulnerable ActiveX component and leaves affected
systems still vulnerable to this issue.

Set the kill-bit for the affected ActiveX control.

PROVIDED AND/OR DISCOVERED BY:
Peter Vreugdenhil, reported via iDefense Labs.

CHANGELOG:
2008-05-02: Updated advisory based on additional information from
iDefense Labs.
2008-05-06: Updated "Solution" section with additional information
from Secunia Research.

ORIGINAL ADVISORY:
Akamai:
http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061923.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=695

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------