PT-2008-2691 · Acresso · Acresso Installshield Update Agent

Brian Dowling · Published 2008-09-17 · Updated 2018-10-11 · CVE-2008-1093

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Acresso InstallShield Update Agent (affected versions not specified)

Description The issue concerns the failure of Acresso InstallShield Update Agent to properly verify the authenticity of Rule Scripts obtained from GetRules.asp web pages on FLEXnet Connect servers. This allows remote man-in-the-middle attackers to execute arbitrary VBScript code via Trojan horse Rules.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-1093

Affected Products

Acresso Installshield Update Agent

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-1093 · Security Note
• http://kb.cert.org/vuls/id/837092 · Note
• http://securityfocus.com/archive/1/496389/100/0/threaded · Note
• http://securitytracker.com/id?1020893 · Note
• http://simplicity.net/vuln/CVE-2008-1093.txt · Note
• http://securityfocus.com/bid/31204 · Note
• http://securityreason.com/securityalert/4268 · Note
• http://vupen.com/english/advisories/2008/2613 · Note
• http://secunia.com/advisories/31896 · Note