HP Fixes Flaws in Software Update

Users of Hewlett-Packard and Compaq desktop and notebook PCs should run Software Update on these computers to patch flaws in the update service’s ActiveX control, according to a security warning issued by HP.

The bugs in the ActiveX control can be used to execute remote code or gain additional access rights, accordingly.

The flaws were disclosed last week by a Polish researcher known as ‘porkythepig’. He showed that an attack, enabled by these vulnerabilities, would leave any affected PC unbootable.

“That would essentially ‘brick’ the system, since many HP and Compaq PCs do not include a restore CD or DVD, but instead place operating system and application restore files on the hard drive,” the report says.

Source