PT-2007-2540 · Kaspersky · Kaspersky Anti-Virus+1
Published
2007-04-05
·
Updated
2018-10-16
·
CVE-2007-1112
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Kaspersky Anti-Virus version 6.0
Kaspersky Internet Security version 6.0
Description
The issue allows remote attackers to download or delete arbitrary files via crafted arguments to certain methods in ActiveX controls. Specifically, the vulnerable methods are:
(1)
DeleteFile(),
(2) StartBatchUploading(),
(3) StartStrBatchUploading(), and
(4) StartUploading().
These methods are part of the AXKLPROD60Lib.KAV60Info and AXKLSYSINFOLib.SysInfo ActiveX controls in the AxKLProd60.dll and AxKLSysInfo.dll libraries, respectively.Recommendations
For Kaspersky Anti-Virus version 6.0 and Kaspersky Internet Security version 6.0, consider disabling the
DeleteFile(), StartBatchUploading(), StartStrBatchUploading(), and StartUploading() methods in the AXKLPROD60Lib.KAV60Info and AXKLSYSINFOLib.SysInfo ActiveX controls as a temporary workaround until a patch is available.
Restrict access to the AxKLProd60.dll and AxKLSysInfo.dll libraries to minimize the risk of exploitation.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Kaspersky Anti-Virus
Kaspersky Internet Security