PT-2007-3053 · Dassault Systèmes · Solidworks

Published 2007-04-06 · Updated 2017-07-29 · CVE-2007-1684

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SolidWorks sldimdownload ActiveX control versions prior to 16.0.0.6

Description: The issue allows remote attackers to execute arbitrary commands. This is achieved via the installerpath and applicationarguments arguments in the Run function of the sldimdownload.dll.

Recommendations: For versions prior to 16.0.0.6, update to version 16.0.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Run function in the sldimdownload ActiveX control to minimize the risk of exploitation. Avoid using the installerpath and applicationarguments arguments in the affected ActiveX control until the issue is resolved.

Fix

Related Identifiers

CVE-2007-1684

Affected Products

Solidworks

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-1684 · Security Note
• http://securityfocus.com/bid/23290 · Vendor Advisory
• http://kb.cert.org/vuls/id/556801 · Patch
• http://secunia.com/advisories/24762 · Vendor Advisory
• http://securitytracker.com/id?1017855 · Vendor Advisory
• http://osvdb.org/34320 · Note
• http://vupen.com/english/advisories/2007/1216 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33428 · Note