PT-2008-5804 · Macrovision · Macrovision Flexnet Connect

Elazar · Publicado 2008-10-15 · Atualizado 2017-09-29 · CVE-2008-4587

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Macrovision FLEXnet Connect version 6.1

Description The issue concerns an insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control. This vulnerability allows remote attackers to force the download and execution of arbitrary files via the AddFile and RunScheduledJobs methods. It could potentially be leveraged for code execution by uploading executable files to Startup folders.

Recommendations For Macrovision FLEXnet Connect version 6.1, consider disabling the AddFile and RunScheduledJobs methods in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control as a temporary workaround until a patch is available. Restrict access to the Startup folders to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2008-4587

Produtos afetados

Macrovision Flexnet Connect

Referências · 7

• 🔥 https://exploit-db.com/exploits/4909 · Exploit
• http://secunia.com/advisories/28496 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-4587 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0145 · Nota
• http://securityfocus.com/bid/27279 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39653 · Nota
• http://securityreason.com/securityalert/4428 · Nota