PT-2011-3942 · Uusee · Uuplayer Activex Control+1

Published 2011-08-09 · Updated 2017-08-29 · CVE-2011-2590

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UUSee 2010 version 6.11.0609.2 UUPlayer ActiveX control version 6.0.0.1

Description The issue allows remote attackers to execute arbitrary programs. This is achieved via a UNC share pathname in the MPlayerPath parameter of the Play method in the UUPlayer ActiveX control.

Recommendations For UUSee 2010 version 6.11.0609.2, consider disabling the Play method in the UUPlayer ActiveX control until a patch is available. For UUPlayer ActiveX control version 6.0.0.1, restrict the use of the MPlayerPath parameter to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-2590

Affected Products

Uuplayer Activex Control

Uusee

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-2590 · Security Note
• http://secunia.com/secunia_research/2011-59 · Vendor Advisory
• http://secunia.com/advisories/44885 · Vendor Advisory
• http://securityfocus.com/bid/48975 · Note
• http://osvdb.org/74217 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68975 · Note