PT-2012-1405 · Viscom · Imageviewer2.Ocx+2

Dr_Ide · Publicado 2012-08-31 · Atualizado 2017-08-29 · CVE-2010-5193

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Viscom Image Viewer CP Pro version 8.0 Viscom Image Viewer Gold version 6.0

Description The issue is a stack-based buffer overflow in the TIFMergeMultiFiles function, located in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx). This allows remote attackers to execute arbitrary code via a long strDelimit parameter.

Recommendations For Viscom Image Viewer CP Pro version 8.0, consider disabling the TIFMergeMultiFiles function until a patch is available. For Viscom Image Viewer Gold version 6.0, restrict access to the SCRIBBLE.ScribbleCtrl.1 ActiveX control to minimize the risk of exploitation. Avoid using the strDelimit parameter in the affected ActiveX control until the issue is resolved.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-5193

Produtos afetados

Imageviewer2.Ocx

Viscom Image Viewer Cp Pro

Viscom Image Viewer Gold

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb · Exploit
• 🔥 https://exploit-db.com/exploits/15668 · Exploit
• 🔥 http://exploit-db.com/exploits/18123 · Exploit
• 🔥 https://exploit-db.com/exploits/18123 · Exploit
• 🔥 http://exploit-db.com/exploits/15668 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63666 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-5193 · Nota de Segurança
• http://secunia.com/advisories/42445 · Aviso do Fabricante