PT-2015-3486 · Idrive+1 · Idrive Online Backup+1
Published
2015-01-01
·
Updated
2015-01-03
·
CVE-2011-5290
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
IDrive Online Backup version 3.4.0
Description
The issue concerns the SaveToFile method in the UniBasicPack.UniTextBox ActiveX control, which allows remote attackers to write to arbitrary files by specifying a pathname in the first argument.
Recommendations
For IDrive Online Backup version 3.4.0, consider disabling the SaveToFile method in the UniBasicPack.UniTextBox ActiveX control until a patch is available. Restrict access to this method to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Idrive Online Backup
Unibasicpack.Unitextbox Activex Control