PT-2011-3942 · Uusee · Uuplayer Activex Control+1

Publicado 2011-08-09 · Atualizado 2017-08-29 · CVE-2011-2590

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UUSee 2010 version 6.11.0609.2 UUPlayer ActiveX control version 6.0.0.1

Description The issue allows remote attackers to execute arbitrary programs. This is achieved via a UNC share pathname in the MPlayerPath parameter of the Play method in the UUPlayer ActiveX control.

Recommendations For UUSee 2010 version 6.11.0609.2, consider disabling the Play method in the UUPlayer ActiveX control until a patch is available. For UUPlayer ActiveX control version 6.0.0.1, restrict the use of the MPlayerPath parameter to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-2590

Produtos afetados

Uuplayer Activex Control

Uusee

Referências · 6

• http://securityfocus.com/bid/48975 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2590 · Nota de Segurança
• http://secunia.com/secunia_research/2011-59 · Aviso do Fabricante
• http://osvdb.org/74217 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68975 · Nota
• http://secunia.com/advisories/44885 · Aviso do Fabricante