PT-2008-6102 · Mw6 Technologies · Mw6Pdf417Lib.Pdf417

Deltahackingteam · Published 2008-11-04 · Updated 2017-09-29 · CVE-2008-4926

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MW6PDF417Lib.PDF417 version 3.0.0.1

Description The issue concerns insecure methods in the MW6 Technologies PDF417 ActiveX control, allowing remote attackers to overwrite arbitrary files. This is achieved by providing a full pathname argument to the SaveAsBMP and SaveAsWMF methods.

Recommendations For version 3.0.0.1, consider disabling the SaveAsBMP and SaveAsWMF methods until a patch is available to prevent remote attackers from overwriting arbitrary files. Restrict access to the MW6PDF417.dll library to minimize the risk of exploitation. Avoid using the full pathname argument in the affected methods until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2008-4926

Affected Products

Mw6Pdf417Lib.Pdf417

References · 4

• 🔥 https://exploit-db.com/exploits/6873 · Exploit
• http://secunia.com/advisories/32425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4926 · Security Note
• http://securityfocus.com/bid/31983 · Note