PT-2007-2437 · Macrovision · Installanywhere Enterprise

Publicado 2007-04-19 · Atualizado 2018-10-16 · CVE-2007-1009

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Macrovision InstallAnywhere Enterprise versions prior to 8.0.1

Description: The issue allows local users to perform unauthorized installations by modifying the InstallScript.iap xml configuration file, which is used without integrity protection to verify authorization for installing an application. This can be achieved by removing the password or serial number verification sections from this file.

Recommendations: For versions prior to 8.0.1, update to version 8.0.1 or later to resolve the issue. As a temporary workaround, consider implementing additional access controls to the InstallScript.iap xml configuration file to prevent unauthorized modifications. Restrict access to this file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-1009

Produtos afetados

Installanywhere Enterprise

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1009 · Nota
• http://securityreason.com/securityalert/2596 · Nota
• http://securityfocus.com/bid/22643 · Correção
• http://securityfocus.com/archive/1/466035/100/0/threaded · Nota
• http://vupen.com/english/advisories/2007/1433 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1009 · Nota de Segurança
• http://symantec.com/content/en/us/enterprise/research/SYMSA-2007-003.txt · Aviso do Fabricante