Security threats Toolkit

HP patches 'critical' flaw in 100 laptop models

Liam Tung ZDNet Australia

Published: 18 Dec 2007 13:30 GMT

HP has released a patch which disables its Info Center shortcut tool, used in 100 different HP laptop models, in an attempt to work around a design flaw.

HP has labelled the flaw "critical". It affects 15 variations of HP's Compaq Presario Notebook PC series, three in the HP 500 Notebook model series, 46 in the HP Compaq Notebook PC series, and 14 in the HP Pavilion Notebook PC series, as well as other models, according to HP's security notice.

News of the flaw was reported by a researcher using the name "porkythepig" on the Bugtraq security bulletin on 11 December. The researcher discovered that flaws in HPInfoDLL.dll — one of the ActiveX controls used within HP Info Center — could allow remote attackers to carry out a number of malicious activities.

These include installing malware, changing registry information in preparation for a more sophisticated attack, using the machine in a denial-of-service attack and stealing sensitive data from documents on the compromised machine.

For the flaw to be exploited, the user of an affected laptop would need to visit a specially crafted website.

Exploit code has been posted on vulnerability-alert site milw0rm and on SecurityFocus's Bugtraq.

CNET News.com's Robert Vamosi and ZDNet.co.uk's Tom Espiner contributed to this article.