PT-2007-6095 · Cowon · Jetflext.Dll+2

H07 + 1 · Publicado 2007-09-19 · Atualizado 2017-09-29 · CVE-2007-4983

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions jetAudio versions 7.0.3 through 7.0.3.3016

Description The issue allows remote attackers to create or overwrite arbitrary local files via a .. (dot dot backslash) in the second argument to the DownloadFromMusicStore method. This can be leveraged for code execution by overwriting JetAudio.exe, which is launched by the control after completion of the method call.

Recommendations For versions 7.0.3 through 7.0.3.3016, consider disabling the DownloadFromMusicStore method until a patch is available to prevent exploitation. Restrict access to the JetAudio.Interface.1 ActiveX control in JetFlExt.dll to minimize the risk of arbitrary file creation or overwrite.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-4983

Produtos afetados

Jetaudio.Interface.1 Activex Control

Jetflext.Dll

Jetaudio

Referências · 8

• 🔥 https://exploit-db.com/exploits/4427 · Exploit
• http://osvdb.org/37737 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36693 · Nota
• http://vupen.com/english/advisories/2007/3196 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4983 · Nota de Segurança
• http://secunia.com/advisories/26787 · Aviso do Fabricante
• http://securitytracker.com/id?1018716 · Nota
• http://securityfocus.com/bid/25723 · Nota