Detections
Analytics
Camtasia Studio Pre-generated SWF File csPreloader Parameter Unspecified Arbitrary Code Execution
medium Nessus Plugin ID 29899
Synopsis
The remote Windows host contains an application that reportedly allows arbitrary code execution.Description
Camtasia Studio, an application for recording videos, is installed on the remote host.The version of Camtasia Studio on the remote host reportedly generates Flash (SWF) files that themselves allow loading of an arbitrary Flash file via the 'csPreloader' parameter, which could lead to cross-site scripting attacks against a web server hosting vulnerable SWF files or even execution of arbitrary code on a user's system.
Solution
Upgrade to Camtasia Studio 5.0 or later as that reportedly resolves the issue and regenerate SWF content. Note that upgrading by itself is not sufficient to resolve this issue.See Also
Plugin Details
Severity: Medium
ID: 29899
File Name: camtasia_cspreloader_cmd_exec.nasl
Version: 1.18
Type: local
Agent: windows
Family: Windows
Published: 1/10/2008
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
Required KB Items: SMB/Registry/Enumerated
Exploit Available: true
Exploit Ease: Exploits are available
Reference Information
CVE: CVE-2008-6061
BID: 27107