Detections
Analytics
GdPicture Multiple ActiveX Control SaveAsPDF Method Arbitrary File Overwrite
high Nessus Plugin ID 34348
Synopsis
The remote Windows host has an ActiveX control that allows overwriting arbitrary files.Description
The remote host contains the GdPicturePro5S.Imaging or GdPicture4S.Imaging ActiveX control, which is used to manipulate images in a variety of formats.The version of the control installed on the remote host reportedly fails to validate input to the 'sFilePath' argument of the 'SaveAsPDF' method. If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, this method could be used to create or overwrite arbitrary files on the affected system subject to the user's privileges, which could in turn lead to execution of arbitrary code.
Solution
Upgrade to GdPicture Light Imaging Toolkit 4.7.2 (with version 4.7.0.2 of the control) / GdPicture Pro Imaging SDK 5.7.2 (with version 5.7.0.2 of the control) or later.See Also
Plugin Details
Severity: High
ID: 34348
File Name: gdpicture_imaging_activex_saveaspdf_unsafe.nasl
Version: 1.20
Type: local
Agent: windows
Family: Windows
Published: 10/6/2008
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
Required KB Items: SMB/Registry/Enumerated
Exploit Available: true
Exploit Ease: Exploits are available
Reference Information
CVE: CVE-2008-4453
BID: 31504