PT-2008-5960 · Db Software Laboratory · Vimp X

Shinnai · Published 2008-10-27 · Updated 2017-09-29 · CVE-2008-4749

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DB Software Laboratory VImp X versions 4.7.7 through 4.8.8.0

Description The issue concerns insecure methods in the VImpX.VImpAX ActiveX control, allowing remote attackers to overwrite arbitrary files. This can be achieved via the LogFile property and ClearLogFile method, as well as the SaveToFile method.

Recommendations For version 4.7.7, consider disabling the ClearLogFile method and restricting access to the SaveToFile method until a fix is available. For version 4.8.8.0, avoid using the LogFile property and restrict access to the SaveToFile method until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2008-4749

Affected Products

Vimp X

References · 5

• 🔥 https://exploit-db.com/exploits/6828 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4749 · Security Note
• http://securityfocus.com/bid/31907 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46096 · Note
• http://securityreason.com/securityalert/4509 · Note