Article

Government warns of dangerous QuickBooks Online flaw

Bill Brenner

The U.S. Computer Emergency Readiness Team (US-CERT) has issued an alert regarding two security flaws attackers could exploit in the popular Intuit QuickBooks Online Edition to cause buffer overflows and download or upload files using compromised machines.

QuickBooks Online Edition is the Web-based version of Intuit's accounting program and is particularly popular among small businesses. It functions as an ActiveX control within Internet Explorer (IE). According to US-CERT researcher Will Dormann, the ActiveX control contains several "dangerous" methods attackers could exploit to hijack computers and steal sensitive data.

"The Intuit QuickBooks Online Edition ActiveX control fails to properly restrict access to dangerous methods, which could allow a remote attacker to execute arbitrary code on a vulnerable system," he explained in

    Requires Free Membership to View

US-CERT Vulnerability Note VU#979638. "By convincing a victim to view an HTML document (Web page, HTML email or email attachment), an attacker could download arbitrary files to a vulnerable system within the security context of the user running IE."

Dormann added that these files could be laced with malicious code. "The user may click the file inadvertently, or the file may be placed in a sensitive location, such as the Windows Startup folder, where it will automatically execute the next time the user logs onto the system," he warned. "An attacker can also retrieve arbitrary files from a victim's computer."

Danish vulnerability clearinghouse Secunia labeled the flaws highly critical because of the attacker's ability to exploit them remotely. In Secunia advisory SA26659, the firm said it confirmed the flaws in QuickBooks version 9 and warned that other versions may also be affected.

Users can eliminate the threat by updating to version 10 or setting the kill-bit for the affected ActiveX controls.

Sharna Brockett, public relations manager with Intuit, said in an email Thursday afternoon that the current version of QuickBooks Online Edition does not have the ActiveX issue referenced by CERT.

"We take all security concerns seriously and therefore began investigating the CERT issue as soon as it was brought to our attention," she said. "Earlier this year, we released a solution, version 10 of QuickBooks Online Edition, which automatically removed the old ActiveX control and required all users to automatically upgrade to version 10 upon logging into their accounts."


There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: