PT-2008-3266 · Ibiz · Ibiz E-Banking Integrator

Shinnai · Publicado 2008-04-11 · Atualizado 2017-09-29 · CVE-2008-1725

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:M/Au:N/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBiz E-Banking Integrator versions 2.0.2932

Description The issue concerns the IBizEBank.FIProfile.1 ActiveX control in the fiprofile20.ocx file, which exposes an unsafe method. This method allows remote attackers to overwrite arbitrary files by providing a full pathname in the argument.

Recommendations For version 2.0.2932, consider disabling the WriteOFXDataFile method as a temporary workaround until a patch is available. Restrict access to the fiprofile20.ocx file to minimize the risk of exploitation. Avoid using the full pathname argument in the affected method until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2008-1725

Produtos afetados

Ibiz E-Banking Integrator

Referências · 6

• 🔥 https://exploit-db.com/exploits/5416 · Exploit
• 🔥 http://securityfocus.com/bid/28700 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1725 · Nota de Segurança
• http://osvdb.org/44393 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41752 · Nota
• http://secunia.com/advisories/29758 · Aviso do Fabricante