PT-2013-5949 · Wellintech · Kchartxy.Ocx+1

Blake · Publicado 2013-10-25 · Atualizado 2013-10-28 · CVE-2013-6128

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions WellinTech KingView versions prior to 6.53 KChartXY.ocx versions prior to 65.30.30000.10002

Description The issue concerns the KCHARTXYLib.KChartXY ActiveX control, which does not properly restrict SaveToFile method calls. This allows remote attackers to create or overwrite arbitrary files and subsequently execute arbitrary programs via a single pathname argument. A directory traversal attack can be used to exploit this issue.

Recommendations For WellinTech KingView versions prior to 6.53, update to version 6.53 or later. For KChartXY.ocx versions prior to 65.30.30000.10002, update to version 65.30.30000.10002 or later. As a temporary workaround, consider restricting access to the SaveToFile method in the KChartXY.ocx control to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-6128

Produtos afetados

Kchartxy.Ocx

Kingview

Referências · 4

• 🔥 http://exploit-db.com/exploits/28085 · Exploit
• 🔥 https://exploit-db.com/exploits/28085 · Exploit
• http://ics-cert.us-cert.gov/advisories/ICSA-13-295-01 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-6128 · Nota de Segurança