{"assessment": {"system": "", "name": "", "href": ""}, "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "type": "cve", "viewCount": 0, "bulletinFamily": "NVD", "scanner": [], "edition": 1, "cvelist": ["CVE-2009-1567"], "published": "2009-12-03T12:30:00", "objectVersion": "1.2", "history": [], "title": "CVE-2009-1567", "reporter": "NVD", "hash": "bdd535434fc19d557eaf9a65142b205d19ab5506364bf244afaea2a0603f95f2", "lastseen": "2016-09-03T12:22:18", "id": "CVE-2009-1567", "description": "Multiple stack-based buffer overflows in the Lateral Arts Photobox uploader ActiveX control 1.x before 1.3, and 2.2.0.6, allow remote attackers to execute arbitrary code via a long URL string for the (1) LogURL, (2) ConnectURL, (3) SkinURL, (4) AlbumCreateURL, (5) ErrorURL, or (6) httpsinglehost property value.", "modified": "2009-12-07T00:00:00", "references": ["http://www.securityfocus.com/bid/37187", "http://www.vupen.com/english/advisories/2009/3377", "http://www.securityfocus.com/archive/1/archive/1/508169/100/0/threaded", "http://www.vupen.com/english/advisories/2009/3376"], "cpe": ["cpe:/a:larts:uploader_activex_control:2.2.0.6"], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1567", "enchantments": {"score": {"value": 9.3, "vector": "NONE", "modified": "2016-09-03T12:22:18"}, "vulnersScore": 9.3}}

{"securityvulns": [{"lastseen": "2018-08-31T11:10:32", "references": [], "description": "====================================================================== \r\n\r\n Secunia Research 02/12/2009\r\n\r\n - Lateral Arts uploader ActiveX Control Buffer Overflow -\r\n\r\n====================================================================== \r\nTable of Contents\r\n\r\nAffected Software....................................................1\r\nSeverity.............................................................2\r\nDescription of Vulnerability.........................................3\r\nSolution.............................................................4\r\nTime Table...........................................................5\r\nCredits..............................................................6\r\nReferences...........................................................7\r\nAbout Secunia........................................................8\r\nVerification.........................................................9\r\n\r\n====================================================================== \r\n1&#41; Affected Software \r\n\r\n* Lateral Arts Photobox uploader ActiveX Control 2.2.0.6\r\n\r\nNOTE: Other versions may also be affected.\r\n\r\n====================================================================== \r\n2&#41; Severity \r\n\r\nRating: Highly critical\r\nImpact: System compromise\r\nWhere: Remote\r\n\r\n====================================================================== \r\n3&#41; Description of Vulnerability\r\n\r\nSecunia Research has discovered a vulnerability in Lateral Arts \r\nPhotobox uploader ActiveX Control, which can be exploited by \r\nmalicious people to compromise a user&#39;s system.\r\n\r\nThe vulnerability is caused by a boundary error when parsing URLs. \r\nThis can be exploited to cause a stack-based buffer overflow via an \r\noverly long string assigned to a number of properties &#40;e.g. &quot;LogURL&quot;,\r\n&quot;ConnectURL&quot;, &quot;SkinURL&quot;, &quot;AlbumCreateURL&quot;, &quot;ErrorURL&quot;, and \r\n&quot;httpsinglehost&quot;&#41;.\r\n\r\nSuccessful exploitation allows execution of arbitrary code when a \r\nuser e.g. visits a malicious website.\r\n\r\nThe vulnerability is confirmed in version 2.2.0.6. Other versions may \r\nalso be affected.\r\n\r\n====================================================================== \r\n4&#41; Solution \r\n\r\nAccording to the vendor &#40;Lateral Arts&#41;, the vulnerability is fixed\r\nin version 1.3 of the upstream version.\r\n\r\nNo fixed version is available for the Photobox 2.x branch.\r\n\r\n====================================================================== \r\n5&#41; Time Table \r\n\r\n02/11/2009 - Vendor &#40;Lateral Arts&#41; notified.\r\n02/11/2009 - Vendor response.\r\n11/11/2009 - Status update requested.\r\n11/11/2009 - Vendor response &#40;customers contacted&#41;.\r\n18/11/2009 - Status update requested.\r\n18/11/2009 - Vendor response.\r\n25/11/2009 - Disclosure postponed.\r\n30/11/2009 - Vendor provides status update.\r\n02/12/2009 - Public disclosure.\r\n\r\n====================================================================== \r\n6&#41; Credits \r\n\r\nDiscovered by Carsten Eiram, Secunia Research.\r\n\r\n====================================================================== \r\n7&#41; References\r\n\r\nThe Common Vulnerabilities and Exposures &#40;CVE&#41; project has assigned \r\nCVE-2009-1567 for the vulnerability.\r\n\r\n====================================================================== \r\n8&#41; About Secunia\r\n\r\nSecunia offers vulnerability management solutions to corporate\r\ncustomers with verified and reliable vulnerability intelligence\r\nrelevant to their specific system configuration:\r\n\r\nhttp://secunia.com/advisories/business_solutions/\r\n\r\nSecunia also provides a publicly accessible and comprehensive advisory\r\ndatabase as a service to the security community and private \r\nindividuals, who are interested in or concerned about IT-security.\r\n\r\nhttp://secunia.com/advisories/\r\n\r\nSecunia believes that it is important to support the community and to\r\ndo active vulnerability research in order to aid improving the \r\nsecurity and reliability of software in general:\r\n\r\nhttp://secunia.com/secunia_research/\r\n\r\nSecunia regularly hires new skilled team members. Check the URL below\r\nto see currently vacant positions:\r\n\r\nhttp://secunia.com/corporate/jobs/\r\n\r\nSecunia offers a FREE mailing list called Secunia Security Advisories:\r\n\r\nhttp://secunia.com/advisories/mailing_lists/\r\n\r\n====================================================================== \r\n9&#41; Verification \r\n\r\nPlease verify this advisory by visiting the Secunia website:\r\nhttp://secunia.com/secunia_research/2009-41/\r\n\r\nComplete list of vulnerability reports published by Secunia Research:\r\nhttp://secunia.com/secunia_research/\r\n\r\n======================================================================", "edition": 1, "reporter": "Securityvulns", "published": "2009-12-02T00:00:00", "title": "Secunia Research: Lateral Arts Photobox uploader ActiveX Control Buffer Overflow", "type": "securityvulns", "enchantments": {"score": {"modified": "2018-08-31T11:10:32", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2009-1567"], "modified": "2009-12-02T00:00:00", "id": "SECURITYVULNS:DOC:22860", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:22860", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "kaspersky": [{"lastseen": "2018-09-13T06:47:39", "references": [], "description": "### *CVSS*:\n9.3\n\n### *Detect date*:\n12/03/2009\n\n### *Severity*:\nCritical\n\n### *Description*:\nA buffer overflow was found in LA Photobox Uploader. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed URL.\n\n### *Affected products*:\nLateral Arts Photobox Uploader 1 versions 1.2 and earlier \nLateral Arts Photobox Uploader 2 version 2.2.0.6\n\n### *Solution*:\nUpdate to latest version\n\n### *Original advisories*:\n[Juniper description](<http://junipercloud.net/security/auto/vulnerabilities/vuln37187.html>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Photobox Uploader ActiveX Control](<https://threats.kaspersky.com/en/product/Photobox-Uploader-ActiveX-Control/>)\n\n### *CVE-IDS*:\n[CVE-2009-1567](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1567>)", "edition": 12, "reporter": "Kaspersky Lab", "published": "2009-12-03T00:00:00", "title": "\r KLA10241ACE vulnerability in Lateral Arts Photobox Uploader ", "type": "kaspersky", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "info", "cvelist": ["CVE-2009-1567"], "modified": "2018-09-10T00:00:00", "id": "KLA10241", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10241", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}