PT-2007-3751 · Macrovision · Macrovision Flexnet Connect+1

Publicado 2007-06-06 · Atualizado 2018-10-16 · CVE-2007-2419

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Macrovision FLEXnet Connect versions 6.0 Macrovision FLEXnet Update Service versions 3.x through 5.x

Description The issue is related to multiple buffer overflows in an ActiveX control (boisweb.dll) that allow remote attackers to execute arbitrary code. This can be achieved via the second parameter to the DownloadAndExecute method and the third parameter to the AddFileEx method.

Recommendations For Macrovision FLEXnet Connect version 6.0, update to a version that addresses the buffer overflows in the ActiveX control. For Macrovision FLEXnet Update Service versions 3.x through 5.x, update to a version that addresses the buffer overflows in the ActiveX control. As a temporary workaround, consider disabling the DownloadAndExecute and AddFileEx methods until a patch is available.

Correção

Identificadores relacionados

CVE-2007-2419

Produtos afetados

Macrovision Flexnet Connect

Macrovision Flexnet Update Service

Referências · 10

• http://support.installshield.com/kb/view.asp?articleid=Q113020 · Correção
• http://dvlabs.tippingpoint.com/advisory/TPTI-07-09 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34721 · Nota
• http://securitytracker.com/id?1018195 · Nota
• http://vupen.com/english/advisories/2007/2070 · Nota
• http://securityfocus.com/archive/1/470585/100/0/threaded · Nota
• http://secunia.com/advisories/25509 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2419 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2419 · Nota
• http://osvdb.org/36983 · Nota