PT-2009-3665 · Php Live! · Php Live!

Nine:Situations:Group · Publicado 2009-03-25 · Atualizado 2017-09-29 · CVE-2009-1087

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PPLive versions 1.9.21 and earlier

Description The issue allows remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast, (2) Play, (3) pplsv, or (4) ppvod URI handler.

Recommendations For versions 1.9.21 and earlier, consider restricting access to the UNC share pathname in the LoadModule argument to minimize the risk of exploitation. As a temporary workaround, avoid using the LoadModule argument in the affected URI handlers until a fix is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-1087

Produtos afetados

Php Live!

Referências · 5

• 🔥 https://exploit-db.com/exploits/8215 · Exploit
• http://secunia.com/advisories/34327 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1087 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49263 · Nota
• http://vupen.com/english/advisories/2009/0739 · Aviso do Fabricante