iMesh IMWeb.IMWebControl ActiveX (IMWeb.dll) SetHandler Method Arbitrary Code Execution

High Nessus Plugin ID 31050


The remote Windows host has an ActiveX control that allows arbitrary command execution.


The IMWeb.IMWebControl.1 ActiveX control, included with the IMesh peer-to-peer file sharing application, is installed on the remote host. It reportedly allows arbitrary command execution through its 'SetHandler' method. If a remote attacker can trick a user on the affected host into visiting a specially crafted web page, he may be able to leverage this issue to execute arbitrary code on the affected host subject to the user's privileges.


Unknown at this time.

See Also

Plugin Details

Severity: High

ID: 31050

File Name: imesh_imwebcontrol_activex_sethandler_code_exec.nasl

Version: $Revision: 1.11 $

Type: local

Agent: windows

Family: Windows

Published: 2008/02/13

Modified: 2017/07/10

Dependencies: 13855

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:U/RC:ND

Vulnerability Information

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: No exploit is required

Reference Information

CVE: CVE-2007-6493

BID: 26916

Secunia: 28134

OSVDB: 40239

CWE: 20