PT-2015-3486 · Idrive+1 · Idrive Online Backup+1

Publicado 2015-01-01 · Atualizado 2015-01-03 · CVE-2011-5290

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions IDrive Online Backup version 3.4.0

Description The issue concerns the SaveToFile method in the UniBasicPack.UniTextBox ActiveX control, which allows remote attackers to write to arbitrary files by specifying a pathname in the first argument.

Recommendations For IDrive Online Backup version 3.4.0, consider disabling the SaveToFile method in the UniBasicPack.UniTextBox ActiveX control until a patch is available. Restrict access to this method to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-5290

Produtos afetados

Idrive Online Backup

Unibasicpack.Unitextbox Activex Control

Referências · 2

• 🔥 https://htbridge.com/advisory/HTB23025 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5290 · Nota de Segurança