PT-2007-6392 · Pegasus Imaging · Imagxpress

Publicado 2007-10-09 · Atualizado 2017-07-29 · CVE-2007-5320

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Pegasus Imaging ImagXpress version 8.0

Description: The issue allows remote attackers to perform absolute path traversal attacks. This can be achieved in two ways: (1) by deleting arbitrary files via the CacheFile attribute in the ThumbnailXpress.1 ActiveX control, or (2) by overwriting arbitrary files via the CompactFile function in the ImagXpress.8 ActiveX control.

Recommendations: For Pegasus Imaging ImagXpress version 8.0, consider disabling the ThumbnailXpress.1 and ImagXpress.8 ActiveX controls to prevent exploitation until a patch is available. Restrict access to the CacheFile attribute and the CompactFile function to minimize the risk of arbitrary file deletion or overwrite. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5320

Produtos afetados

Imagxpress

Referências · 11

• 🔥 http://securityfocus.com/bid/25948 · Exploit
• 🔥 https://exploit-db.com/exploits/4488 · Exploit
• 🔥 http://shinnai.altervista.org/exploits/txt/TXT_3DQ1nIkI6zmWCek4zP5U.html · Exploit
• 🔥 http://shinnai.altervista.org/exploits/txt/TXT_wfv7ZG0G6KnQlk1SieLd.html · Exploit
• http://vupen.com/english/advisories/2007/3388 · Nota
• http://secunia.com/advisories/27095 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37012 · Nota
• http://osvdb.org/37959 · Nota
• http://securityfocus.com/bid/25949 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5320 · Nota de Segurança
• http://osvdb.org/37960 · Nota