PT-2007-5665 · Ecentrex · Uacomx.Ocx+2

Rgod · Published 2007-08-22 · Updated 2017-09-29 · CVE-2007-4489

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions eCentrex VOIP Client module using uacomx.ocx version 2.0.1

Description The issue is related to a buffer overflow in the IUAComFormX ActiveX control. This can be exploited by remote attackers to execute arbitrary code. The exploitation occurs through a long Username argument to the ReInit method.

Recommendations For version 2.0.1 of uacomx.ocx, consider disabling the ReInit method as a temporary workaround until a patch is available. Restrict access to the IUAComFormX ActiveX control to minimize the risk of exploitation. Avoid using long Username arguments in the affected module until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-4489

Affected Products

Iuacomformx Activex Control

Ecentrex Voip Client

Uacomx.Ocx

References · 8

• 🔥 https://exploit-db.com/exploits/4299 · Exploit
• 🔥 http://securityfocus.com/bid/25383 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4489 · Security Note
• http://osvdb.org/37738 · Note
• http://securitytracker.com/id?1018596 · Note
• http://secunia.com/advisories/26525 · Note
• http://vupen.com/english/advisories/2007/2954 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36129 · Note