Lucene search

[email protected]CVE-2010-1911

HistoryMay 12, 2010 - 11:46 a.m.

CVE-2010-1911

2010-05-1211:46:31

CWE-310

[email protected]

web.nvd.nist.gov

cve-2010-1911

sdcwebsecurebase

consona live assistance

dns hijacking

activex controls

security vulnerability

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.9%

JSON

The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a DNS hijacking attack.

Affected configurations

NVD

Node

consonaconsona_dynamic_agentMatch--enterprise

consonaconsona_dynamic_agentMatch--marketing

consonaconsona_dynamic_agentMatch--support

consonaconsona_live_assistance

consonaconsona_subscriber_assistance

CPENameOperatorVersion
consona:consona_dynamic_agentconsona consona dynamic agenteq-
consona:consona_live_assistanceconsona consona live assistanceeq*
consona:consona_subscriber_assistanceconsona consona subscriber assistanceeq*

CPE	Name	Operator	Version
consona:consona_dynamic_agent	consona consona dynamic agent	eq	-
consona:consona_live_assistance	consona consona live assistance	eq	*
consona:consona_subscriber_assistance	consona consona subscriber assistance	eq	*

References

wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html

www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf

www.kb.cert.org/vuls/id/602801

www.securityfocus.com/archive/1/511176/100/0/threaded

www.wintercore.com/downloads/rootedcon_0day.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/58608

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.9%

JSON

Related for CVE-2010-1911

cvelist1 prion1 nvd1