PT-2007-5270 · Clevercomponents · Clever Internet Activex Suite

Shinnai · Published 2007-07-30 · Updated 2017-09-29 · CVE-2007-4067

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Clever Internet ActiveX Suite version 6.2

Description: The issue is related to an absolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control. This vulnerability allows remote attackers to create or overwrite arbitrary files by providing a full pathname in the second argument to the GetToFile method.

Recommendations: For Clever Internet ActiveX Suite version 6.2, consider restricting access to the clInetSuiteX6.clWebDav ActiveX control until a patch is available. As a temporary workaround, avoid using the GetToFile method with untrusted input to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-4067

Affected Products

Clever Internet Activex Suite

References · 7

• 🔥 http://securityfocus.com/bid/25063 · Exploit
• 🔥 http://attrition.org/pipermail/vim/2007-July/001729.html · Exploit
• 🔥 https://exploit-db.com/exploits/4226 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4067 · Security Note
• http://secunia.com/advisories/26213 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35590 · Note
• http://vupen.com/english/advisories/2007/2659 · Note