PT-2007-3751 · Macrovision · Macrovision Flexnet Connect+1

Published 2007-06-06 · Updated 2018-10-16 · CVE-2007-2419

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Macrovision FLEXnet Connect versions 6.0 Macrovision FLEXnet Update Service versions 3.x through 5.x

Description The issue is related to multiple buffer overflows in an ActiveX control (boisweb.dll) that allow remote attackers to execute arbitrary code. This can be achieved via the second parameter to the DownloadAndExecute method and the third parameter to the AddFileEx method.

Recommendations For Macrovision FLEXnet Connect version 6.0, update to a version that addresses the buffer overflows in the ActiveX control. For Macrovision FLEXnet Update Service versions 3.x through 5.x, update to a version that addresses the buffer overflows in the ActiveX control. As a temporary workaround, consider disabling the DownloadAndExecute and AddFileEx methods until a patch is available.

Fix

Related Identifiers

CVE-2007-2419

Affected Products

Macrovision Flexnet Connect

Macrovision Flexnet Update Service

References · 10

• http://support.installshield.com/kb/view.asp?articleid=Q113020 · Patch
• http://dvlabs.tippingpoint.com/advisory/TPTI-07-09 · Patch
• http://secunia.com/advisories/25509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2419 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34721 · Note
• http://securitytracker.com/id?1018195 · Note
• http://vupen.com/english/advisories/2007/2070 · Note
• http://securityfocus.com/archive/1/470585/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2419 · Note
• http://osvdb.org/36983 · Note