VeriSign ConfigChk ActiveX Control (VSCnfChk.dll) Buffer Overflow

Medium Nessus Plugin ID 24734


The remote Windows host has an ActiveX control that is affected by a buffer overflow vulnerability.


The ConfigChk ActiveX control, included with VeriSign's PKI product on the remote host and marked as safe for scripting, is reportedly affected by a buffer overflow vulnerability involving its 'VerCompare()' method.

If an attacker can trick a user on the affected host into visiting a specially crafted web page, this issue could be leveraged to execute arbitrary code on the host subject to the user's privileges.


Apply the vendor patch and verify that the file version of the associated 'VSCnfChk.dll' is or later.

See Also

Plugin Details

Severity: Medium

ID: 24734

File Name: verisign_configchk_activex_vercompare_overflow.nasl

Version: $Revision: 1.17 $

Type: local

Agent: windows

Family: Windows

Published: 2007/02/28

Modified: 2016/11/03

Dependencies: 13855

Risk Information

Risk Factor: Medium


Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

Required KB Items: SMB/Registry/Enumerated

Exploit Available: false

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2007/02/22

Reference Information

CVE: CVE-2007-1083

BID: 22671

OSVDB: 33479

CERT: 308087

CWE: 119