PT-2007-2437 · Macrovision · Installanywhere Enterprise

Published 2007-04-19 · Updated 2018-10-16 · CVE-2007-1009

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Macrovision InstallAnywhere Enterprise versions prior to 8.0.1

Description: The issue allows local users to perform unauthorized installations by modifying the InstallScript.iap xml configuration file, which is used without integrity protection to verify authorization for installing an application. This can be achieved by removing the password or serial number verification sections from this file.

Recommendations: For versions prior to 8.0.1, update to version 8.0.1 or later to resolve the issue. As a temporary workaround, consider implementing additional access controls to the InstallScript.iap xml configuration file to prevent unauthorized modifications. Restrict access to this file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-1009

Affected Products

Installanywhere Enterprise

References · 7

• http://securityfocus.com/bid/22643 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-1009 · Security Note
• http://symantec.com/content/en/us/enterprise/research/SYMSA-2007-003.txt · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1009 · Note
• http://securityreason.com/securityalert/2596 · Note
• http://securityfocus.com/archive/1/466035/100/0/threaded · Note
• http://vupen.com/english/advisories/2007/1433 · Note