Lucene search

CertccCVE-2009-3735

HistoryFeb 11, 2010 - 5:30 p.m.

CVE-2009-3735

2010-02-1117:30:00

CWE-94

certcc

web.nvd.nist.gov

cve-2009-3735

activescan

activex control

panda activescan

remote code execution

digital signature

arbitrary url

software download

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

Low

EPSS

0.104

Percentile

95.0%

JSON

The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive’s digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.

Affected configurations

Nvd

Node

pandapanda_activescanMatch2.0

VendorProductVersionCPE
pandapanda_activescan2.0cpe:2.3:a:panda:panda_activescan:2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
panda	panda_activescan	2.0	cpe:2.3:a:panda:panda_activescan:2.0:::::::*

References

secunia.com/advisories/38485

www.kb.cert.org/vuls/id/869993

www.kb.cert.org/vuls/id/MAPG-7QPKL3

www.securityfocus.com/bid/38067

www.vupen.com/english/advisories/2010/0354

docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

Low

EPSS

0.104

Percentile

95.0%

JSON

Related for CVE-2009-3735