YokkaSoft Multiple Products Executable Loading Arbitrary Code Execution Vulnerability
BID:44327
Info
YokkaSoft Multiple Products Executable Loading Arbitrary Code Execution Vulnerability
| Bugtraq ID: | 44327 |
| Class: | Design Error |
| CVE: |
CVE-2010-3165 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 22 2010 12:00AM |
| Updated: | Oct 22 2010 12:00AM |
| Credit: | Mr. Makoto |
| Vulnerable: |
YokkaSoft UnEditor 1.10.1.2 YokkaSoft SQLEditorXP 3.14.1.2 YokkaSoft SQLEditorTE 1.9.1.3 YokkaSoft SQLEditorClassic 1.8.1.3 YokkaSoft SQLEditor8 3.8.1.2 YokkaSoft OuiEditor 1.6.1.1 YokkaSoft NoEditor 1.33.1.1 YokkaSoft DeuxEditor 1.7.1.2 |
| Not Vulnerable: | |
Discussion
YokkaSoft Multiple Products Executable Loading Arbitrary Code Execution Vulnerability
Multiple YokkaSoft products are prone to a vulnerability that lets attackers execute arbitrary code.
An attacker can exploit this issue by enticing a legitimate user to use the vulnerable product to open a file from a network share location that contains a specially crafted executable file.
The following products are vulnerable:
NoEditor versions 1.33.1.1 and prior.
OuiEditor versions 1.6.1.1 and prior.
UnEditor versions 1.10.1.2 and prior.
DeuxEditor versions 1.7.1.2 and prior.
SQLEditorXP versions 3.14.1.2 and prior.
SQLEditorTE versions 1.9.1.3 and prior.
SQLEditor8 versions 3.8.1.2 and prior.
SQLEditorClassic versions 1.8.1.3 and prior.
Multiple YokkaSoft products are prone to a vulnerability that lets attackers execute arbitrary code.
An attacker can exploit this issue by enticing a legitimate user to use the vulnerable product to open a file from a network share location that contains a specially crafted executable file.
The following products are vulnerable:
NoEditor versions 1.33.1.1 and prior.
OuiEditor versions 1.6.1.1 and prior.
UnEditor versions 1.10.1.2 and prior.
DeuxEditor versions 1.7.1.2 and prior.
SQLEditorXP versions 3.14.1.2 and prior.
SQLEditorTE versions 1.9.1.3 and prior.
SQLEditor8 versions 3.8.1.2 and prior.
SQLEditorClassic versions 1.8.1.3 and prior.
Exploit / POC
YokkaSoft Multiple Products Executable Loading Arbitrary Code Execution Vulnerability
Attackers must trick a user into opening a file on a remote WebDAV or SMB share to exploit this issue.
Attackers must trick a user into opening a file on a remote WebDAV or SMB share to exploit this issue.
Solution / Fix
YokkaSoft Multiple Products Executable Loading Arbitrary Code Execution Vulnerability
Solution:
Reportedly vendor updates are available. Please contact the vendor for more information.
Solution:
Reportedly vendor updates are available. Please contact the vendor for more information.
References
YokkaSoft Multiple Products Executable Loading Arbitrary Code Execution Vulnerability
References:
References:
- Vendor Homepage (Yokkasoft)