2X Client TuxClientSystem ActiveX InstallClient() Method Arbitrary MSI Package Installation

This script is Copyright (C) 2012-2013 Tenable Network Security, Inc.


Synopsis :

An ActiveX control on the remote Windows host could allow
installation of arbitrary programs.

Description :

The version of the TuxClientSystem ActiveX control, part of the 2X
Client, installed on the remote Windows host is earlier than 10.1
Build 1239. As such, its 'InstallClient()' method reportedly accepts
a URL to an MSI package and allows installation of an application
without explicit user approval.

If an attacker can trick an administrator on the affected system into
viewing a malicious HTML document, he could leverage this issue to
install an arbitrary application on the system.

Solution :

Upgrade to 2X Client 10.1 Build 1239 as that is reported to address
the vulnerability.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.7
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 58321 ()

Bugtraq ID: 52359

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now