PT-2009-3045 · Microsoft · Wow Activex

Michael Brooks · Publicado 2009-02-02 · Atualizado 2017-09-29 · CVE-2009-0389

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WOW ActiveX versions 2

Description The issue concerns multiple insecure methods in the Web On Windows (WOW) ActiveX control. Remote attackers can create and overwrite arbitrary files using the WriteIniFileString method, execute arbitrary programs via the ShellExecute method, read from the registry, and write to the registry. It is also possible to use these methods together to execute arbitrary code.

Recommendations For WOW ActiveX version 2, consider disabling the WriteIniFileString and ShellExecute methods to prevent exploitation until a fix is available. Restrict access to the registry to minimize the risk of unauthorized modifications. Avoid using the WOW ActiveX control for sensitive operations until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2009-0389

Produtos afetados

Wow Activex

Referências · 4

• 🔥 http://securityfocus.com/bid/33515 · Exploit
• 🔥 https://exploit-db.com/exploits/7910 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0389 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48337 · Nota