PT-2010-3192 · Gigabyte · Gigabyte Dldrv2 Activex Control

Published 2010-08-02 · Updated 2010-08-03 · CVE-2010-1517

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GIGABYTE Dldrv2 ActiveX control version 1.4.206.11

Description The issue allows remote attackers to download and execute arbitrary programs onto a client system. This can be achieved through vectors involving the dl method or the SetDLInfo method in conjunction with the Bdl method.

Recommendations For GIGABYTE Dldrv2 ActiveX control version 1.4.206.11, consider disabling the dl and SetDLInfo methods as a temporary workaround until a patch is available. Restrict access to the Bdl method to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-1517

Affected Products

Gigabyte Dldrv2 Activex Control

References · 3

• http://secunia.com/advisories/40161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1517 · Security Note
• http://secunia.com/secunia_research/2010-85 · Vendor Advisory