HP patches 'critical' flaw in 100 laptop models

Summary:Hewlett-Packard has released a patch which disables its Info Center shortcut tool, used in 100 different HP laptop models, in an attempt to work around a design flaw.

Hewlett-Packard has released a patch which disables its Info Center shortcut tool, used in 100 different HP laptop models, in an attempt to work around a design flaw.

HP has labeled the flaw "critical". It affects 15 variations of HP's Compaq Presario Notebook PC series, three in the HP 500 Notebook model series, 46 in the HP Compaq Notebook PC series, and 14 in the HP Pavilion Notebook PC series, as well as other models, according to HP's security notice.

News of the flaw was reported by a researcher using the name "porkythepig" on the Bugtraq security bulletin on 11 December. The researcher discovered that flaws in HPInfoDLL.dll--one of the ActiveX controls used within HP Info Center--could allow remote attackers to carry out a number of malicious activities.

These include installing malware, changing registry information in preparation for a more sophisticated attack, using the machine in a denial-of-service attack and stealing sensitive data from documents on the compromised machine.

For the flaw to be exploited, the user of an affected laptop would need to visit a specially crafted Web site.

Exploit code has been posted on vulnerability-alert site milw0rm and on SecurityFocus's Bugtraq.

CNET News.com's Robert Vamosi and ZDNet.co.uk's Tom Espiner contributed to this article.

Topics: Security, Hardware, Mobility

About

Liam Tung is an Australian business technology journalist living a few too many Swedish miles north of Stockholm for his liking. He gained a bachelors degree in economics and arts (cultural studies) at Sydney's Macquarie University, but hacked (without Norse or malicious code for that matter) his way into a career as an enterprise tech, s... Full Bio

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.