Command injection

2009-09-3015:30:00

PRIOn knowledge base

www.prio-n.com

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.6%

JSON

Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.

CPENameOperatorVersion
photoshop_elementseq8.0

CPE	Name	Operator	Version
	photoshop_elements	eq	8.0

References

blogs.adobe.com/psirt/2009/09/potential_photoshop_elements_8.html

retrogod.altervista.org/9sg_adobe_pe_local.html

secunia.com/advisories/36895

www.securityfocus.com/archive/1/506806/100/0/threaded

www.securityfocus.com/bid/36542

www.securitytracker.com/id?1022963

www.vupen.com/english/advisories/2009/2798