PT-2008-5804 · Macrovision · Macrovision Flexnet Connect

Elazar · Published 2008-10-15 · Updated 2017-09-29 · CVE-2008-4587

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Macrovision FLEXnet Connect version 6.1

Description The issue concerns an insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control. This vulnerability allows remote attackers to force the download and execution of arbitrary files via the AddFile and RunScheduledJobs methods. It could potentially be leveraged for code execution by uploading executable files to Startup folders.

Recommendations For Macrovision FLEXnet Connect version 6.1, consider disabling the AddFile and RunScheduledJobs methods in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control as a temporary workaround until a patch is available. Restrict access to the Startup folders to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2008-4587

Affected Products

Macrovision Flexnet Connect

References · 7

• 🔥 https://exploit-db.com/exploits/4909 · Exploit
• http://secunia.com/advisories/28496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4587 · Security Note
• http://vupen.com/english/advisories/2008/0145 · Note
• http://securityfocus.com/bid/27279 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39653 · Note
• http://securityreason.com/securityalert/4428 · Note