PT-2007-3300 · Skc · Skcrypax Activex Control Module

Publicado 2007-04-11 · Atualizado 2008-11-13 · CVE-2007-1955

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SKCrypAX ActiveX control module version 5.4.1.2

Description The issue allows remote attackers to execute arbitrary code via a long string in unspecified arguments to the (1) DownloadCert, (2) DecryptFileByKey, and (3) EncryptFileByKey functions.

Recommendations For SKCrypAX ActiveX control module version 5.4.1.2, consider disabling the DownloadCert(), DecryptFileByKey(), and EncryptFileByKey() functions as a temporary workaround until a patch is available. Restrict access to these functions to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-1955

Produtos afetados

Skcrypax Activex Control Module

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-1955 · Nota de Segurança
• http://osvdb.org/34322 · Nota
• http://secunia.com/advisories/24820 · Aviso do Fabricante
• http://securityfocus.com/bid/23374 · Nota