PT-2007-7340 · Hewlett Packard · Hp Software Update+1

Porkythepig · Published 2007-12-20 · Updated 2018-10-15 · CVE-2007-6506

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Software Update versions 3.0.8.4 through 4.000.005.007

Description The issue allows remote attackers to overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly access arbitrary files via the LoadDataFromFile method.

Recommendations For HP Software Update versions 3.0.8.4 through 4.000.005.007, consider disabling the SaveToFile and LoadDataFromFile methods until a patch is available. Restrict access to the RulesEngine.dll to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-6506

Affected Products

Hp Software Update

Rulesengine.Dll

References · 13

• 🔥 https://exploit-db.com/exploits/4757 · Exploit
• 🔥 http://securityfocus.com/bid/26950 · Exploit
• http://secunia.com/advisories/28177 · Vendor Advisory
• http://vupen.com/english/advisories/2007/4271 · Vendor Advisory
• http://securityfocus.com/archive/1/485451/100/0/threaded · Vendor Advisory
• http://securityfocus.com/archive/1/485734/100/0/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6506 · Security Note
• http://securitytracker.com/id?1019133 · Note
• http://blogs.zdnet.com/security/?p=768 · Note
• http://it.slashdot.org/it/07/12/20/2327242.shtml · Note
• http://anspi.pl/~porkythepig/hp-issue/wyfukanyszynszyl.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39153 · Note
• http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9053818 · Note