ActiveX Repurposing.. (aka: Other bugs your static analyzer will never find..) (aka 0day^H^H 485day bug!)

The report describes a Juniper SSL‑VPN ActiveX control flaw where the control's self-upgrade and configuration handling can be abused by a malicious webpage: an unsigned upgrade file is downloaded to a predictable path (C:\predictable_location) and a crafted INI file can include an UninstallString with arbitrary commands. By instantiating the control with the malicious INI, an attacker can trigger the uninstall method to execute arbitrary code on the victim's machine, demonstrating a reliable client-side remote code execution vector and highlighting limitations of static analysis tools.