FKIE_CVE-2007-2419

Vulnerability from fkie_nvd - Published: 2007-06-06 10:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple buffer overflows in an ActiveX control (boisweb.dll) in Macrovision FLEXnet Connect 6.0 and Update Service 3.x to 5.x allow remote attackers to execute arbitrary code via the (1) the second parameter to the DownloadAndExecute method and (2) third parameter to the AddFileEx method, a different vulnerability than CVE-2007-0328.
References
cve@mitre.orghttp://dvlabs.tippingpoint.com/advisory/TPTI-07-09Patch
cve@mitre.orghttp://osvdb.org/36983
cve@mitre.orghttp://secunia.com/advisories/25509Vendor Advisory
cve@mitre.orghttp://support.installshield.com/kb/view.asp?articleid=Q113020Patch
cve@mitre.orghttp://www.securityfocus.com/archive/1/470585/100/0/threaded
cve@mitre.orghttp://www.securitytracker.com/id?1018195
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/2070
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34721
af854a3a-2127-422b-91ae-364da2661108http://dvlabs.tippingpoint.com/advisory/TPTI-07-09Patch
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/36983
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25509Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://support.installshield.com/kb/view.asp?articleid=Q113020Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/470585/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1018195
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/2070
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34721
Impacted products
Vendor Product Version
macrovision flexnet_connect 6.0
macrovision update_service 3.0
macrovision update_service 4.0
macrovision update_service 5.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:macrovision:flexnet_connect:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B07D756-3DB4-4ECD-83FD-CB60830F9267",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:macrovision:update_service:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A09B825D-2B5C-4BA8-AF5D-AB0C3FB61BA4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:macrovision:update_service:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "61E90832-465C-4C77-8171-36593FEF3DB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:macrovision:update_service:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8427D006-33CA-4677-9536-26596FB210D9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple buffer overflows in an ActiveX control (boisweb.dll) in Macrovision FLEXnet Connect 6.0 and Update Service 3.x to 5.x allow remote attackers to execute arbitrary code via the (1) the second parameter to the DownloadAndExecute method and (2) third parameter to the AddFileEx method, a different vulnerability than CVE-2007-0328."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples desordamientos de b\u00fafer en un control ActiveX (boisweb.dll) en Macrovision FLEXnet Connect 6.0 y Update Service 3.x hasta 5.x permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de (1) el segudo par\u00e1metro del m\u00e9todo DownloadAndExecute y (2) el tercer par\u00e1metro del m\u00e9todo AddFileEx, una vulnerabilidad diferente de CVE-2007-0328."
    }
  ],
  "id": "CVE-2007-2419",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-06-06T10:30:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://dvlabs.tippingpoint.com/advisory/TPTI-07-09"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/36983"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25509"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://support.installshield.com/kb/view.asp?articleid=Q113020"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/470585/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1018195"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/2070"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34721"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://dvlabs.tippingpoint.com/advisory/TPTI-07-09"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/36983"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25509"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://support.installshield.com/kb/view.asp?articleid=Q113020"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/470585/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1018195"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/2070"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34721"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.