PT-2007-7340 · Hewlett Packard · Hp Software Update+1

Porkythepig · Publicado 2007-12-20 · Atualizado 2018-10-15 · CVE-2007-6506

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Software Update versions 3.0.8.4 through 4.000.005.007

Description The issue allows remote attackers to overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly access arbitrary files via the LoadDataFromFile method.

Recommendations For HP Software Update versions 3.0.8.4 through 4.000.005.007, consider disabling the SaveToFile and LoadDataFromFile methods until a patch is available. Restrict access to the RulesEngine.dll to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-6506

Produtos afetados

Hp Software Update

Rulesengine.Dll

Referências · 13

• 🔥 https://exploit-db.com/exploits/4757 · Exploit
• 🔥 http://securityfocus.com/bid/26950 · Exploit
• http://secunia.com/advisories/28177 · Aviso do Fabricante
• http://securitytracker.com/id?1019133 · Nota
• http://vupen.com/english/advisories/2007/4271 · Aviso do Fabricante
• http://securityfocus.com/archive/1/485451/100/0/threaded · Aviso do Fabricante
• http://blogs.zdnet.com/security/?p=768 · Nota
• http://it.slashdot.org/it/07/12/20/2327242.shtml · Nota
• http://anspi.pl/~porkythepig/hp-issue/wyfukanyszynszyl.txt · Nota
• http://securityfocus.com/archive/1/485734/100/0/threaded · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-6506 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39153 · Nota
• http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9053818 · Nota