Macrovision FLEXnet Connect ActiveX Control Multiple Arbitrary File Download Vulnerabilities

Bugtraq ID:	27279
Class:	Design Error
CVE:	CVE-2008-4587 CVE-2008-4586
Remote:	Yes
Local:	No
Published:	Jan 14 2008 12:00AM
Updated:	Jul 06 2016 02:17PM
Credit:	Elazar Broad is credited with the discovery of these issues.
Vulnerable:	Macrovision FLEXnet Connect 0
Not Vulnerable:

Macrovision FLEXnet Connect ActiveX Control Multiple Arbitrary File Download Vulnerabilities

Macrovision FLEXnet Connect ActiveX controls are prone to multiple vulnerabilities that attackers can exploit to download arbitrary files to affected computers.

Macrovision FLEXnet Connect ActiveX Control Multiple Arbitrary File Download Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to view a malicious web page.

NOTE: The Symantec DeepSight Team has discovered that the issue affecting 'isusweb.dll' is being actively exploited in the wild.

The following exploit code is available:

• /data/vulnerabilities/exploits/27279.html
• /data/vulnerabilities/exploits/27279-2.html

Macrovision FLEXnet Connect ActiveX Control Multiple Arbitrary File Download Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Macrovision FLEXnet Connect ActiveX Control Multiple Arbitrary File Download Vulnerabilities

References:

• FLEXnet Connect Homepage (Macrovision)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)