KLA10186 Multiple vulnerabilities in HP Quick Launch Button

Multiple serious vulnerabilities have been found in HP Quick Launch Button. Malicious users can exploit these vulnerabilities to read and write arbitrary registry entries or execute arbitrary programs Below is a complete list of vulnerabilities

1. Vectors related to GetRegValue and SetRegValue can be exploited remotely;
2. A path traversal vulnerability can be exploited remotely via the LaunchApp method.

Original advisories

Exploitation

Public exploits exist for this vulnerability.

Related products

Quick-Launch-Buttons

CVE list

CVE-2007-6331 critical

CVE-2007-6332 critical

CVE-2007-6333 high

Solution

Update to latest version

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• HP Quick Launch Button versions 6.3 and earlier