PT-2008-2691 · Acresso · Acresso Installshield Update Agent

Brian Dowling · Publicado 2008-09-17 · Atualizado 2018-10-11 · CVE-2008-1093

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Acresso InstallShield Update Agent (affected versions not specified)

Description The issue concerns the failure of Acresso InstallShield Update Agent to properly verify the authenticity of Rule Scripts obtained from GetRules.asp web pages on FLEXnet Connect servers. This allows remote man-in-the-middle attackers to execute arbitrary VBScript code via Trojan horse Rules.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-1093

Produtos afetados

Acresso Installshield Update Agent

Referências · 9

• http://kb.cert.org/vuls/id/837092 · Nota
• http://securityfocus.com/archive/1/496389/100/0/threaded · Nota
• http://securitytracker.com/id?1020893 · Nota
• http://simplicity.net/vuln/CVE-2008-1093.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1093 · Nota de Segurança
• http://securityfocus.com/bid/31204 · Nota
• http://securityreason.com/securityalert/4268 · Nota
• http://vupen.com/english/advisories/2008/2613 · Nota
• http://secunia.com/advisories/31896 · Nota