The Register® — Biting the hand that feeds IT

Acer 'preloads vulns' onto notebooks

Ripe for exploitation

By John Leyden • Get more from this author

Posted in Security, 10th January 2007 18:49 GMT

Free whitepaper – Dell PowerEdge M1000e blade server

Acer has been called out for pre-loading a vulnerability on its notebooks.

A library file, called LunchApp.ocx, on the devices is set up to turn on the "safe for scripting" feature that means users are more vulnerable to ActiveX exploits. The "feature," designed to make it easier to browser Acer's site means systems can download potentially malicious Active X controls, without warning, if they happen to stray onto websites controlled by hackers.

This reduction in security defences was uncovered by security researchers at anti-virus firm F-Secure during testing of the LunchApp.ocx library, as explained here.

Acer is yet to respond to our requests for comment. ®

Free whitepaper – Managing operating systems and applications with the new Dell Management Console

Webcast: Jumpstart your Application Security initiatives