PT-2008-5593 · Chilkat · Chilkat Xml Chilkatutil.Ckdata.1 Activex Control

Shinnai · Publicado 2008-09-30 · Atualizado 2024-02-14 · CVE-2008-4343

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Chilkat XML ChilkatUtil.CkData.1 ActiveX control versions 3.0.3.0 and earlier

Description: The issue allows remote attackers to create, overwrite, and modify arbitrary files for execution via calls to specific methods. This can potentially be leveraged for remote code execution by accessing files using hcp:// URLs. The exploitability might be limited to certain environments or non-default browser settings.

Recommendations: For versions 3.0.3.0 and earlier, consider disabling the SaveToFile, SaveToTempFile, or AppendBinary methods as a temporary workaround until a patch is available. Restrict access to files using hcp:// URLs to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-4343

Produtos afetados

Chilkat Xml Chilkatutil.Ckdata.1 Activex Control

Referências · 6

• 🔥 http://shinnai.net/xplits/TXT_rNowA1916DKFNUF48NyS · Exploit
• 🔥 https://exploit-db.com/exploits/6537 · Exploit
• http://secunia.com/advisories/31951 · Aviso do Fabricante
• http://securityfocus.com/bid/31332 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45333 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4343 · Nota de Segurança