PT-2007-6094 · Mw6 Technologies · Mw6 Technologies Qrcode Activex

Shinnai · Publicado 2007-09-19 · Atualizado 2017-09-29 · CVE-2007-4982

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MW6 Technologies QRCode ActiveX versions 3.0.0.1 and earlier

Description The issue allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) SaveAsBMP or (2) SaveAsWMF method of the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll.

Recommendations For versions 3.0.0.1 and earlier, consider disabling the SaveAsBMP and SaveAsWMF methods until a patch is available to prevent exploitation. Restrict access to the MW6QRCode.dll to minimize the risk of arbitrary file creation or overwrite. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-4982

Produtos afetados

Mw6 Technologies Qrcode Activex

Referências · 9

• 🔥 https://exploit-db.com/exploits/4420 · Exploit
• http://securityfocus.com/bid/25702 · Nota
• http://secunia.com/advisories/26836 · Aviso do Fabricante
• http://shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36666 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4982 · Nota de Segurança
• http://osvdb.org/37914 · Nota
• http://vupen.com/english/advisories/2007/3195 · Nota
• http://osvdb.org/37915 · Nota