PT-2007-2540 · Kaspersky · Kaspersky Anti-Virus+1

Publicado

2007-04-05

·

Atualizado

2018-10-16

·

CVE-2007-1112

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus version 6.0 Kaspersky Internet Security version 6.0
Description The issue allows remote attackers to download or delete arbitrary files via crafted arguments to certain methods in ActiveX controls. Specifically, the vulnerable methods are: (1) DeleteFile(), (2) StartBatchUploading(), (3) StartStrBatchUploading(), and (4) StartUploading(). These methods are part of the AXKLPROD60Lib.KAV60Info and AXKLSYSINFOLib.SysInfo ActiveX controls in the AxKLProd60.dll and AxKLSysInfo.dll libraries, respectively.
Recommendations For Kaspersky Anti-Virus version 6.0 and Kaspersky Internet Security version 6.0, consider disabling the DeleteFile(), StartBatchUploading(), StartStrBatchUploading(), and StartUploading() methods in the AXKLPROD60Lib.KAV60Info and AXKLSYSINFOLib.SysInfo ActiveX controls as a temporary workaround until a patch is available. Restrict access to the AxKLProd60.dll and AxKLSysInfo.dll libraries to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2007-1112

Produtos afetados

Kaspersky Anti-Virus
Kaspersky Internet Security