StudioLine Photo Basic NMSDVDXU.dll ActiveX EnableLog() Arbitrary File Overwrite

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote host has software installed that is affected by an
arbitrary file overwrite vulnerability.

Description :

The remote host has a version of StudioLine Photo Basic less than or
equal to 3.70.34.0 installed. Such versions are affected by an
arbitrary file overwrite vulnerability in the EnableLog() method on
the NMSDVDXU.dll ActiveX control.

By tricking a victim into opening a specially crafted web page, an
attacker could overwrite arbitrary files on the remote host subject to
the user's privileges.

See also :

https://www.htbridge.com/advisory/HTB23024

Solution :

Upgrade to a version of StudioLine Photo Basic greater than 3.70.34.0
or remove / disable the vulnerable ActiveX control.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.6
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 60022 ()

Bugtraq ID: 49192

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now