Detections
Analytics
iMesh IMWeb.IMWebControl ActiveX (IMWeb.dll) SetHandler Method Arbitrary Code Execution
high Nessus Plugin ID 31050
Synopsis
The remote Windows host has an ActiveX control that allows arbitrary command execution.Description
The IMWeb.IMWebControl.1 ActiveX control, included with the IMesh peer-to-peer file sharing application, is installed on the remote host. It reportedly allows arbitrary command execution through its 'SetHandler' method. If a remote attacker can trick a user on the affected host into visiting a specially crafted web page, he may be able to leverage this issue to execute arbitrary code on the affected host subject to the user's privileges.Solution
Unknown at this time.See Also
https://seclists.org/bugtraq/2007/Dec/223
https://www.securityfocus.com/archive/1/485261/30/0/threaded
Plugin Details
Severity: High
ID: 31050
File Name: imesh_imwebcontrol_activex_sethandler_code_exec.nasl
Version: 1.14
Type: local
Agent: windows
Family: Windows
Published: 2/13/2008
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
Required KB Items: SMB/Registry/Enumerated
Exploit Available: true
Exploit Ease: Exploits are available
Reference Information
CVE: CVE-2007-6493
BID: 26916