PT-2007-4130 · Ksign · Ksign Ksignswat Activex Control

Kee Hong + 1 · Publicado 2007-05-22 · Atualizado 2017-07-29 · CVE-2007-2820

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KSign KSignSWAT ActiveX Control version 2.0.3.3

Description The issue is related to multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control. This can be exploited by remote attackers to execute arbitrary code via long arguments to certain functions, including (1) SWAT Init(), (2) SWAT InitEx(), (3) SWAT InitEx2(), (4) SWAT InitEx3(), and (5) SWAT Login().

Recommendations For version 2.0.3.3, as a temporary workaround, consider disabling the SWAT Init(), SWAT InitEx(), SWAT InitEx2(), SWAT InitEx3(), and SWAT Login() functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-2820

Produtos afetados

Ksign Ksignswat Activex Control

Referências · 8

• 🔥 https://exploit-db.com/exploits/3968 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2820 · Nota de Segurança
• http://securityfocus.com/bid/24088 · Nota
• http://secunia.com/advisories/25357 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1901 · Nota
• http://osvdb.org/36517 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34417 · Nota
• http://marc.info/?l=full-disclosure&m=117981953312669&w=2 · Correção