PT-2011-2949 · Data Dynamics+1 · Data Dynamics Activebar+1

Published 2011-05-05 · Updated 2023-05-30 · CVE-2011-1207

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Data Dynamics ActiveBar ActiveX controls version 1.0.6.5 IBM Rational System Architect versions 11.4.0.2, 11.4.0.1, and earlier

Description The issue is related to the ActiveBar1 ActiveX control, which does not properly restrict the SetLayoutData method. This allows remote attackers to execute arbitrary code via a crafted Data argument.

Recommendations For IBM Rational System Architect versions 11.4.0.2, 11.4.0.1, and earlier, consider restricting access to the SetLayoutData method until a patch is available. For Data Dynamics ActiveBar ActiveX controls version 1.0.6.5, restrict the use of the SetLayoutData method to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2011-1207

Affected Products

Data Dynamics Activebar

Ibm Rational System Architect

References · 7

• http://secunia.com/advisories/43399 · Vendor Advisory
• http://secunia.com/advisories/43474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1207 · Security Note
• https://ibm.com/support/docview.wss?uid=swg21497689 · Vendor Advisory
• http://vupen.com/english/advisories/2011/1129 · Vendor Advisory
• http://securitytracker.com/id?1025464 · Note
• http://securityfocus.com/bid/47643 · Note