The RealPage Module Upload ActiveX control is prone to an overflow condition. It fails to properly sanitize user-supplied input resulting in a buffer overflow. With a specially crafted overly long 'DestURL' or 'SourceFile' property value, a remote attacker can potentially execute arbitrary code.
Classification
Location:
Context Dependent
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Workaround,
Upgrade
Exploit:
Exploit Unknown
Disclosure:
RBS Confirmed,
Uncoordinated Disclosure
OSVDB:
Web Related
Solution
Upgrade to version 1.0.0.10 or higher, as it has been reported to fix this vulnerability. It is also possible to temporarily work around the flaw by implementing the following workaround: set the kill-bit on the RealPage Upload ActiveX Control. See Microsoft KB article 240797 for additional details.
