Detections
Analytics

Siemens Solid Edge SEListCtrlX ActiveX Control SetItemReadOnly Method Memory Address Write Arbitrary Code Execution

high Nessus Plugin ID 66839

Language:

Synopsis

The remote host has an ActiveX control that is affected by a code execution vulnerability.

Description

The remote host has the Siemens Solid Edge SEListCtrlX ActiveX control installed. This control has a flaw that could allow an attacker to execute arbitrary code via the 'SetItemReadOnly()' method by tricking a user into opening a specially crafted web page.

Solution

Disable the SEListCtrlX ActiveX control.

See Also

http://retrogod.altervista.org/9sg_siemens_adv_ii.htm

https://support.microsoft.com/en-us/help/240797/how-to-stop-an-activex-control-from-running-in-internet-explorer

Plugin Details

Severity: High

ID: 66839

File Name: siemens_solidedge_selistctrlx_activex.nasl

Version: 1.8

Type: local

Agent: windows

Family: Windows

Published: 6/7/2013

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

CPE: x-cpe:/a:siemens:solid_edge

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/26/2013

Exploitable With

Metasploit (Siemens Solid Edge ST4 SEListCtrlX ActiveX Remote Code Execution)

Reference Information

BID: 60161