PT-2008-5726 · Microsoft · Picturepusher Activex Control+1

Rgod · Publicado 2008-10-08 · Atualizado 2017-09-29 · CVE-2008-4493

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Digital Image 2006 Starter Edition

Description: The issue allows remote attackers to force the upload of arbitrary files by using the AddString and Post methods and a modified PostURL to construct an HTTP POST request. This is achieved through the Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709). It is noted that this issue might only be exploitable in limited environments or non-default browser settings.

Recommendations: For Microsoft Digital Image 2006 Starter Edition, consider disabling the use of the Microsoft PicturePusher ActiveX control until a patch is available. Restrict access to the AddString and Post methods to minimize the risk of exploitation. Avoid using the PostURL parameter in the affected control to construct HTTP POST requests until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-4493

Produtos afetados

Digital Image

Picturepusher Activex Control

Referências · 6

• 🔥 https://exploit-db.com/exploits/6699 · Exploit
• 🔥 http://securityfocus.com/bid/31632 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45735 · Nota
• http://securityreason.com/securityalert/4376 · Nota
• http://securitytracker.com/id?1021018 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4493 · Nota de Segurança