Code injection

🗓️ 20 Jan 2009 16:30:00Reported by PRIOn knowledge baseType

The LaunchObj ActiveX control in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not validate downloaded files, allowing remote code execution

Reporter	Title	Published	Views	Family All 20
Tenable Nessus	Symantec AppStream Client LaunchObj ActiveX Control Multiple Unsafe Methods (SYM09-001)	17 Jan 200900:00	–	nessus
Circl	CVE-2008-4388	24 Nov 201000:00	–	circl
Check Point Advisories	Update Protection against Symantec AppStream Client LaunchObj ActiveX Control Program Execution	23 Jan 200900:00	–	checkpoint_advisories
Check Point Advisories	Symantec AppStream Client LaunchObj ActiveX Control (CVE-2008-4388)	16 May 201000:00	–	checkpoint_advisories
Check Point Advisories	Symantec AppStream Client LaunchObj ActiveX Control Code Execution (CVE-2008-4388)	16 Apr 201200:00	–	checkpoint_advisories
CVE	CVE-2008-4388	20 Jan 200916:00	–	cve
Cvelist	CVE-2008-4388	20 Jan 200916:00	–	cvelist
d2	DSquare Exploit Pack: D2SEC_APPSTREAM	20 Jan 200916:30	–	d2
Exploit DB	Symantec AppStream LaunchObj - ActiveX Control Arbitrary File Download and Execute (Metasploit)	24 Nov 201000:00	–	exploitdb
Metasploit	Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute	18 Jan 200902:19	–	metasploit

Source	Link
kb	www.kb.cert.org/vuls/id/194505
securitytracker	www.securitytracker.com/id
securityfocus	www.securityfocus.com/bid/33247
symantec	www.symantec.com/avcenter/security/Content/2009.01.15.html

18 May 2009 04:00Current

7.9High risk

Vulners AI Score7.9

EPSS0.63442