CVE-2010-1908

Опубликовано: 12 мая 2010

Источник: nvd

CVSS2: 9.3

EPSS Низкий

Описание

The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance does not properly restrict access to the HTTPDownloadFile, HTTPGetFile, Install, and RunCmd methods, which allows remote attackers to execute arbitrary programs via a URL in the url argument to (1) HTTPDownloadFile or (2) HTTPGetFile.

Ссылки

http://secunia.com/advisories/39751
Vendor Advisory
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
http://www.kb.cert.org/vuls/id/602801
Patch
US Government Resource
http://www.securityfocus.com/archive/1/511176/100/0/threaded
http://www.wintercore.com/downloads/rootedcon_0day.pdf
Exploit
http://secunia.com/advisories/39751
Vendor Advisory
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
http://www.kb.cert.org/vuls/id/602801
Patch
US Government Resource
http://www.securityfocus.com/archive/1/511176/100/0/threaded
http://www.wintercore.com/downloads/rootedcon_0day.pdf
Exploit

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:consona:consona_dynamic_agent:-:-:enterprise:*:*:*:*:*

cpe:2.3:a:consona:consona_dynamic_agent:-:-:marketing:*:*:*:*:*

cpe:2.3:a:consona:consona_dynamic_agent:-:-:support:*:*:*:*:*

cpe:2.3:a:consona:consona_live_assistance:*:*:*:*:*:*:*:*

cpe:2.3:a:consona:consona_subscriber_assistance:*:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.03719

Низкий

9.3 Critical

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-c5xw-x5m5-vx6w

github

больше 3 лет назад