PT-2010-3536 · Consona+1 · Sdcwebsecurebase+5

Rubén Santamarta · Publicado 2010-05-11 · Atualizado 2018-10-10 · CVE-2010-1913

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Consona Live Assistance, Dynamic Agent, and Subscriber Assistance (affected versions not specified)

Description The issue concerns the default configuration of pluginlicense.ini for the SdcWebSecureBase interface in tgctlcm.dll. This configuration contains an incorrect DNS whitelist that includes the DNS hostnames of home computers of many persons. As a result, remote attackers can bypass intended restrictions on ActiveX execution by hosting an ActiveX control on an applicable home web server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2010-1913

Produtos afetados

Activex

Consona Live Assistance

Dynamic Agent

Sdcwebsecurebase

Subscriber Assistance

Tgctlcm.Dll

Referências · 5

• 🔥 http://wintercore.com/downloads/rootedcon_0day.pdf · Exploit
• http://kb.cert.org/vuls/id/602801 · Correção
• http://securityfocus.com/archive/1/511176/100/0/threaded · Nota
• http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1913 · Nota de Segurança