PT-2010-3193 · Gigabyte · Gigabyte Dldrv2 Activex Control

Published 2010-08-02 · Updated 2010-08-03 · CVE-2010-1518

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GIGABYTE Dldrv2 ActiveX control version 1.4.206.11

Description The issue is related to an array index error in the SetDLInfo method of the GIGABYTE Dldrv2 ActiveX control. This error can be exploited by remote attackers to execute arbitrary code or cause a denial of service due to memory corruption. The exploitation is possible via the item argument.

Recommendations For GIGABYTE Dldrv2 ActiveX control version 1.4.206.11, consider disabling the SetDLInfo method as a temporary workaround until a patch is available. Restrict access to the item argument in the affected ActiveX control to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-1518

Affected Products

Gigabyte Dldrv2 Activex Control

References · 3

• http://secunia.com/secunia_research/2010-86 · Vendor Advisory
• http://secunia.com/advisories/40161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1518 · Security Note