StudioLine Photo Basic NMSDVDXU.dll ActiveX EnableLog() Arbitrary File Overwrite

medium Nessus Plugin ID 60022

Language:

Synopsis

The remote host has software installed that is affected by an arbitrary file overwrite vulnerability.

Description

The remote host has a version of StudioLine Photo Basic less than or equal to 3.70.34.0 installed. Such versions are affected by an arbitrary file overwrite vulnerability in the EnableLog() method on the NMSDVDXU.dll ActiveX control.

By tricking a victim into opening a specially crafted web page, an attacker could overwrite arbitrary files on the remote host subject to the user's privileges.

Solution

Upgrade to a version of StudioLine Photo Basic greater than 3.70.34.0 or remove / disable the vulnerable ActiveX control.

Plugin Details

Severity: Medium

ID: 60022

File Name: studioline_photobasic_activex_enablelog.nasl

Version: 1.6

Type: local

Agent: windows

Family: Windows

Published: 7/18/2012

Updated: 8/8/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: x-cpe:/a:studioline:photobasic

Required KB Items: SMB/Registry/Enumerated, SMB/StudioLine_PhotoBasic/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/27/2011

Vulnerability Publication Date: 8/15/2011

Reference Information

BID: 49192

Detections

Analytics