PT-2008-6100 · Mw6 Technologies · Barcodeax.Dll+1

Deltahackingteam · Publicado 2008-11-04 · Atualizado 2017-09-29 · CVE-2008-4924

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BARCODELib.MW6Barcode, Barcode.dll version 3.0.0.1

Description The issue concerns insecure methods in the MW6 Technologies 1D Barcode ActiveX control, allowing remote attackers to overwrite arbitrary files. This is achieved by providing a full pathname argument to the (1) SaveAsBMP and (2) SaveAsWMF methods.

Recommendations For version 3.0.0.1, consider disabling the SaveAsBMP and SaveAsWMF methods until a patch is available to prevent remote attackers from overwriting arbitrary files. Restrict access to the Barcode.dll module to minimize the risk of exploitation. Avoid using the full pathname argument in the affected methods until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2008-4924

Produtos afetados

Barcodelib.Mw6Barcode

Barcodeax.Dll

Referências · 5

• 🔥 https://exploit-db.com/exploits/6871 · Exploit
• http://secunia.com/advisories/32425 · Aviso do Fabricante
• http://securityfocus.com/bid/31979 · Nota
• http://securityreason.com/securityalert/4562 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4924 · Nota de Segurança