Samsung Kies < 2.5.0.12094_27_11 Multiple ActiveX Control Vulnerabilities

high Nessus Plugin ID 65612

Language:

Synopsis

The remote host has ActiveX controls that are affected by multiple vulnerabilities.

Description

The version of Samsung Kies ActiveX controls installed on the remote host is affected by multiple vulnerabilities :

 - A vulnerability in GetDataTable() method in 'DCAPARAGONGM.dll' is affected by a NULL pointer dereference that could be used to perform a denial of service of the program. (CVE-2012-3806)

 - Multiple vulnerabilities exist affecting CmdAgentLib in 'CmdAgent.dll'. An attacker may be able to exploit this issue to gain elevated privileges. (CVE-2012-3807, CVE-2012-3808 CVE-2012-3809, CVE-2012-3810)

Solution

Upgrade to Samsung Kies 2.5.0.12094_27_11 or later.

See Also

https://www.htbridge.com/advisory/HTB23099

Plugin Details

Severity: High

ID: 65612

File Name: samsung_kies_activex_2_5_0.nasl

Version: 1.5

Type: local

Agent: windows

Family: Windows

Published: 3/19/2013

Updated: 7/27/2018

Supported Sensors: Nessus Agent

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:samsung:kies

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/5/2012

Vulnerability Publication Date: 10/15/2012

Exploitable With

CANVAS (White_Phosphorus)

Reference Information

CVE: CVE-2012-3806, CVE-2012-3807, CVE-2012-3808, CVE-2012-3809, CVE-2012-3810

BID: 55936