UUSee UUUpgrade ActiveX Control 'Update' Method Arbitrary File Download Vulnerability

Bugtraq ID:	29963
Class:	Input Validation Error
CVE:	CVE-2008-7168
Remote:	Yes
Local:	No
Published:	Jun 26 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Symantec Security Intelligence Analysis Team discovered this issue via Honeypot Analysis.
Vulnerable:	UUSee.com UUSee 2008
Not Vulnerable:

UUSee UUUpgrade ActiveX Control 'Update' Method Arbitrary File Download Vulnerability

UUSee is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer.

Attackers may exploit this issue to overwrite sensitive files with malicious data that will compromise the affected computer. Other attacks are possible.

UUSee 2008 is vulnerable; other versions may also be affected.

UUSee UUUpgrade ActiveX Control 'Update' Method Arbitrary File Download Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.

NOTE: Symantec has discovered evidence of active exploits in the wild.

The following exploit code is available:

• /data/vulnerabilities/exploits/29963.html

UUSee UUUpgrade ActiveX Control 'Update' Method Arbitrary File Download Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

UUSee UUUpgrade ActiveX Control 'Update' Method Arbitrary File Download Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Vendor Homepage (UUSee.com)