2X Client TuxClientSystem ActiveX InstallClient() Method Arbitrary MSI Package Installation

High Nessus Plugin ID 58321


An ActiveX control on the remote Windows host could allow installation of arbitrary programs.


The version of the TuxClientSystem ActiveX control, part of the 2X Client, installed on the remote Windows host is earlier than 10.1 Build 1239. As such, its 'InstallClient()' method reportedly accepts a URL to an MSI package and allows installation of an application without explicit user approval.

If an attacker can trick an administrator on the affected system into viewing a malicious HTML document, he could leverage this issue to install an arbitrary application on the system.


Upgrade to 2X Client 10.1 Build 1239 as that is reported to address the vulnerability.

Plugin Details

Severity: High

ID: 58321

File Name: 2x_tuxclientsystem_activex_installclient.nasl

Version: $Revision: 1.4 $

Type: local

Agent: windows

Family: Windows

Published: 2012/03/12

Modified: 2013/05/23

Dependencies: 13855

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2012/03/01

Vulnerability Publication Date: 2012/03/08

Reference Information

BID: 52359

OSVDB: 79869

EDB-ID: 18624

Secunia: 47661