PT-2007-3053 · Dassault Systèmes · Solidworks

Publicado 2007-04-06 · Atualizado 2017-07-29 · CVE-2007-1684

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SolidWorks sldimdownload ActiveX control versions prior to 16.0.0.6

Description: The issue allows remote attackers to execute arbitrary commands. This is achieved via the installerpath and applicationarguments arguments in the Run function of the sldimdownload.dll.

Recommendations: For versions prior to 16.0.0.6, update to version 16.0.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Run function in the sldimdownload ActiveX control to minimize the risk of exploitation. Avoid using the installerpath and applicationarguments arguments in the affected ActiveX control until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-1684

Produtos afetados

Solidworks

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-1684 · Nota de Segurança
• http://osvdb.org/34320 · Nota
• http://vupen.com/english/advisories/2007/1216 · Nota
• http://securityfocus.com/bid/23290 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/556801 · Correção
• http://secunia.com/advisories/24762 · Aviso do Fabricante
• http://securitytracker.com/id?1017855 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33428 · Nota