PT-2007-3225 · Kaspersky · Kl.Sysinfo Activex Control+2

Published 2007-04-05 · Updated 2017-07-29 · CVE-2007-1879

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Kaspersky Anti-Virus versions prior to 6.0.2.614 Kaspersky Internet Security versions prior to 6.0.2.614

Description: The issue allows remote attackers to read arbitrary files by triggering an outbound anonymous FTP session that invokes the PUT command, specifically through the StartUploading function in the KL.SysInfo ActiveX control.

Recommendations: For Kaspersky Anti-Virus versions prior to 6.0.2.614, update to version 6.0.2.614 or later. For Kaspersky Internet Security versions prior to 6.0.2.614, update to version 6.0.2.614 or later.

Fix

Related Identifiers

CVE-2007-1879

Affected Products

Kl.Sysinfo Activex Control

Kaspersky Anti-Virus

Kaspersky Internet Security

References · 10

• http://secunia.com/advisories/24778 · Vendor Advisory
• http://kaspersky.com/technews?id=203038694 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1879 · Security Note
• http://xforce.iss.net/xforce/xfdb/33464 · Note
• http://frsirt.com/english/advisories/2007/1268 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=504 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33464 · Note
• http://vupen.com/english/advisories/2007/1268 · Note
• http://securityfocus.com/bid/23325 · Note
• http://securitytracker.com/id?1017871 · Note