TITLE:
INTUIT Products AnswerWorks ACTIVEX Control Buffer Overflow

SECUNIA ADVISORY ID:
SA26670

VERIFY ADVISORY:
http://secunia.com/advisories/26670/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
TurboTax 2006
http://secunia.com/product/15083/
TurboTax 2005
http://secunia.com/product/15558/
TurboTax 2004
http://secunia.com/product/16890/
TurboTax 2003
http://secunia.com/product/16889/
Quicken 2008
http://secunia.com/product/16891/
QuickBooks Simple START 3.x
http://secunia.com/product/16887/
QuickBooks Simple Start 2007
http://secunia.com/product/16888/
QuickBooks Simple Start 1.x
http://secunia.com/product/16886/
QuickBooks Enterprise 7.x
http://secunia.com/product/16885/
QuickBooks Enterprise 6.x
http://secunia.com/product/16884/
QuickBooks Enterprise 5.x
http://secunia.com/product/16883/
QuickBooks 2007
http://secunia.com/product/16882/
QuickBooks 2006
http://secunia.com/product/16881/
QuickBooks 2005
http://secunia.com/product/16880/
Intuit ProSeries 2006
http://secunia.com/product/16904/
Intuit ProSeries 2005
http://secunia.com/product/16903/
Intuit ProSeries 2004
http://secunia.com/product/16902/
Intuit ProSeries 2003
http://secunia.com/product/16901/
QuickTax 2003
http://secunia.com/product/16905/
QuickTax 2004
http://secunia.com/product/16906/
QuickTax 2005
http://secunia.com/product/16907/
QuickTax 2006
http://secunia.com/product/16908/
QuickBooks 2003
http://secunia.com/product/16909/
QuickBooks 2004
http://secunia.com/product/16910/
Intuit Clearly Bookkeeping 2003
http://secunia.com/product/16911/
Intuit Clearly Bookkeeping 2004
http://secunia.com/product/16912/
QuickBooks Credit Card Processing Kit
http://secunia.com/product/16913/
QuickBooks Invoice Manager
http://secunia.com/product/16914/

DESCRIPTION:
Parvez Anwar has discovered a vulnerability in various Intuit
products, which can be exploited by MALICIOUS people to compromise a
user's system.

The vulnerability is caused due to a boundary error in the
third-party AnswerWorks ActiveX control.

For more information:
SA26566

The vulnerability is confirmed in TurboTax Basic 2005. Please see the
vendor's advisory for a list of affected products and versions.

SOLUTION:
Apply patches.
http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx