PT-2007-5240 · Tenable Network Security+1 · Nessus Vulnerability Scanner+2

H07 + 1 · Published 2007-07-27 · Updated 2017-09-29 · CVE-2007-4031

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions: Nessus Vulnerability Scanner version 3.0.6

Description: The issue allows remote attackers to delete arbitrary files via a .. (dot dot) in the argument to the deleteReport method, probably related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll. This is a directory traversal vulnerability in a certain ActiveX control.

Recommendations: For Nessus Vulnerability Scanner version 3.0.6, consider disabling the deleteReport method until a patch is available to prevent remote attackers from deleting arbitrary files. Restrict access to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll to minimize the risk of exploitation. Avoid using the .. (dot dot) sequence in the argument to the deleteReport method until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-4031

Affected Products

Nessus

Nessus Activex Control

Nessus Vulnerability Scanner

References · 10

• 🔥 https://exploit-db.com/exploits/4237 · Exploit
• 🔥 https://exploit-db.com/exploits/4230 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4031 · Security Note
• http://secunia.com/advisories/26243 · Vendor Advisory
• http://milw0rm.com/exploits/4230 · Note
• http://securityfocus.com/bid/25088 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35641 · Note
• http://securitytracker.com/id?1018469 · Note
• http://nessus.org/news · Note
• http://vupen.com/english/advisories/2007/2680 · Note