PT-2012-4032 · Microsoft+1 · Internet Explorer+1

Derek Soeder · Publicado 2012-04-25 · Atualizado 2021-07-23 · CVE-2012-2421

Positive Technologies (AI Summary)

CVSS v2.0

1.8

Baixa

Vetor base

AV:A/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Intuit QuickBooks versions 2009 through 2012

Description The issue is related to an absolute path traversal vulnerability in the intu-help-qb handlers. This might allow remote attackers to read arbitrary files in ZIP archives via a full pathname in the URI when Internet Explorer is used.

Recommendations For Intuit QuickBooks versions 2009 through 2012, consider restricting access to the HelpAsyncPluggableProtocol.dll handlers as a temporary workaround until a patch is available. Avoid using Internet Explorer with these versions of Intuit QuickBooks to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2012-2421

Produtos afetados

Internet Explorer

Intuit Quickbooks

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-2421 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75172 · Nota
• http://securityfocus.com/archive/1/522139 · Nota
• http://kb.cert.org/vuls/id/232979 · Nota