PT-2005-5258 · Spb · Spb Kiosk Engine

Published 2005-12-30 · Updated 2018-10-19 · CVE-2005-4590

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Spb Kiosk Engine version 1.0.0.1

Description The issue allows local users to bypass restrictions on allowed applications. This can be achieved through removable media containing a program that will execute due to the autorun setting, or through applications that can invoke other applications. For example, a file: URL specifying a .exe file can be used to execute an application.

Recommendations For Spb Kiosk Engine version 1.0.0.1, consider disabling the autorun setting for removable media to prevent unauthorized execution of programs. Additionally, restrict the ability of applications to invoke other applications to minimize the risk of bypassing restrictions.

Fix

Related Identifiers

CVE-2005-4590

Affected Products

Spb Kiosk Engine

References · 5

• http://secunia.com/advisories/18243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4590 · Security Note
• http://airscanner.com/security/05083102_kioskremove.htm · Vendor Advisory
• http://securityfocus.com/archive/1/420450/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23905 · Note