PT-2011-2272 · Dell · Dellsystemlite.Ocx

Published 2011-02-21 · Updated 2011-03-18 · CVE-2011-0329

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DellSystemLite.ocx version 1.0.0.0

Description The issue allows remote attackers to read arbitrary files via directory traversal sequences in the fileID parameter of the GetData method in the DellSystemLite.Scanner ActiveX control.

Recommendations For DellSystemLite.ocx version 1.0.0.0, avoid using the fileID parameter in the GetData method until the issue is resolved. Consider restricting access to the DellSystemLite.Scanner ActiveX control to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-0329

Affected Products

Dellsystemlite.Ocx

References · 5

• http://secunia.com/advisories/42880 · Vendor Advisory
• http://secunia.com/secunia_research/2011-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0329 · Security Note
• http://securityfocus.com/bid/46443 · Note
• http://securitytracker.com/id?1025094 · Note