PT-2012-2990 · Sony · Vaio Easy Connect+2

Published 2012-06-07 · Updated 2017-08-29 · CVE-2012-0985

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sony VAIO PC Wireless LAN Wizard versions 1.0 through 3.0 SmartWi Connection Utility versions 4.7 through 4.11 VAIO Easy Connect software versions 1.0.0 through 1.1.0

Description The issue is related to multiple buffer overflows in the Wireless Manager ActiveX control. This can be exploited by remote attackers to cause a denial of service or possibly execute arbitrary code. The exploitation occurs via a long string in the second argument of the SetTmpProfileOption or ConnectToNetwork method.

Recommendations For Sony VAIO PC Wireless LAN Wizard versions 1.0 through 3.0, consider disabling the SetTmpProfileOption and ConnectToNetwork methods until a patch is available. For SmartWi Connection Utility versions 4.7 through 4.11, restrict access to the Wireless Manager ActiveX control to minimize the risk of exploitation. For VAIO Easy Connect software versions 1.0.0 through 1.1.0, avoid using the SetTmpProfileOption and ConnectToNetwork methods in the Wireless Manager ActiveX control until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-0985

Affected Products

Smartwi Connection Utility

Sony Vaio Pc Wireless Lan Wizard

Vaio Easy Connect

References · 9

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-05/0147.html · Exploit
• 🔥 http://exploit-db.com/exploits/18958 · Exploit
• 🔥 https://exploit-db.com/exploits/18958 · Exploit
• http://esupport.sony.com/US/perl/support-info.pl?template_id=1&info_id=946 · Vendor Advisory
• http://secunia.com/advisories/49340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0985 · Security Note
• http://securityfocus.com/bid/53735 · Note
• http://osvdb.org/82401 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75978 · Note