VeriSign ConfigChk ActiveX Control (VSCnfChk.dll) Buffer Overflow

medium Nessus Plugin ID 24734

Synopsis

The remote Windows host has an ActiveX control that is affected by a buffer overflow vulnerability.

Description

The ConfigChk ActiveX control, included with VeriSign's PKI product on the remote host and marked as safe for scripting, is reportedly affected by a buffer overflow vulnerability involving its 'VerCompare()' method.

If an attacker can trick a user on the affected host into visiting a specially crafted web page, this issue could be leveraged to execute arbitrary code on the host subject to the user's privileges.

Solution

Apply the vendor patch and verify that the file version of the associated 'VSCnfChk.dll' is 2.0.0.3 or later.

Plugin Details

Severity: Medium

ID: 24734

File Name: verisign_configchk_activex_vercompare_overflow.nasl

Version: 1.19

Type: local

Agent: windows

Family: Windows

Published: 2/28/2007

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: SMB/Registry/Enumerated

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2/22/2007

Reference Information

CVE: CVE-2007-1083

BID: 22671

CWE: 119

CERT: 308087

Detections

Analytics