Samsung Kies < 2.5.0.12094_27_11 Multiple ActiveX Control Vulnerabilities

High Nessus Plugin ID 65612

Synopsis

The remote host has ActiveX controls that are affected by multiple vulnerabilities.

Description

The version of Samsung Kies ActiveX controls installed on the remote host is affected by multiple vulnerabilities :

- A vulnerability in GetDataTable() method in 'DCAPARAGONGM.dll' is affected by a NULL pointer dereference that could be used to perform a denial of service of the program. (CVE-2012-3806)

- Multiple vulnerabilities exist affecting CmdAgentLib in 'CmdAgent.dll'. An attacker may be able to exploit this issue to gain elevated privileges. (CVE-2012-3807, CVE-2012-3808 CVE-2012-3809, CVE-2012-3810)

Solution

Upgrade to Samsung Kies 2.5.0.12094_27_11 or later.

See Also

https://www.htbridge.com/advisory/HTB23099

Plugin Details

Severity: High

ID: 65612

File Name: samsung_kies_activex_2_5_0.nasl

Version: 1.5

Type: local

Agent: windows

Family: Windows

Published: 2013/03/19

Updated: 2018/07/27

Dependencies: 13855

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:samsung:kies

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2012/10/05

Vulnerability Publication Date: 2012/10/15

Exploitable With

CANVAS (White_Phosphorus)

Reference Information

CVE: CVE-2012-3806, CVE-2012-3807, CVE-2012-3808, CVE-2012-3809, CVE-2012-3810

BID: 55936

EDB-ID: 22007