PT-2010-3536 · Consona+1 · Sdcwebsecurebase+5

Rubén Santamarta · Published 2010-05-11 · Updated 2018-10-10 · CVE-2010-1913

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Consona Live Assistance, Dynamic Agent, and Subscriber Assistance (affected versions not specified)

Description The issue concerns the default configuration of pluginlicense.ini for the SdcWebSecureBase interface in tgctlcm.dll. This configuration contains an incorrect DNS whitelist that includes the DNS hostnames of home computers of many persons. As a result, remote attackers can bypass intended restrictions on ActiveX execution by hosting an ActiveX control on an applicable home web server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2010-1913

Affected Products

Activex

Consona Live Assistance

Dynamic Agent

Sdcwebsecurebase

Subscriber Assistance

Tgctlcm.Dll

References · 5

• 🔥 http://wintercore.com/downloads/rootedcon_0day.pdf · Exploit
• http://kb.cert.org/vuls/id/602801 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-1913 · Security Note
• http://securityfocus.com/archive/1/511176/100/0/threaded · Note
• http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html · Note