Mark Litchfield and John Heasman of NGSSoftware have discovered two high risk vulnerabilities in the AtHoc Toolbar. The AtHoc toolbar is a plugin for Microsoft's Internet Explorer. The toolbar is redistributed to users of eBay Accenture ThomasRegister ThomasRegional Juniper Networks WiredNews CarFax Agile PLM The flaws, that include a remotely exploitable buffer overflow and a format string bug, have been fixed by AtHoc and an updated toolbar has been distributed to the affected companies. Clients of any of the companies listed above that have installed the toolbar should ensure that they download the updated version. NGSSoftware are going to withhold details about these flaws for three months. Full details will be published on the 6th of January 2005. This three month window will allow users of the toolbar the time needed to obtain the updated version before the details are released to the general public. This reflects NGSSoftware's new approach to responsible disclosure. NGSSoftware Insight Security Research http://www.databasesecurity.com/ http://www.nextgenss.com/ +44(0)208 401 0070
