Summary
This host is installed with Edraw PDF Viewer ActiveX Control and is prone to Insecure Method vulnerability.
Impact
Attacker may leverage this issue for code execution.
Impact Level: System/Application
Solution
Upgrade to Edraw PDF Viewer Component version to 3.2.0.126 http://www.edrawsoft.com/pdfviewer.php
Workaround:
Set the killbit for the CLSID {44A8091F-8F01-43B7-8CF7-4BBA71E61E04} http://support.microsoft.com/kb/240797
Insight
- Error in 'PDFVIEWER.PDFViewerCtrl.1' ActiveX control in 'pdfviewer.ocx', and it can exploited via a URL argument to the FtpConnect argument and a target filename argument to the 'FtpDownloadFile' method.
Affected
Edraw PDF Viewer Component version prior to 3.2.0.126
References
Severity
Classification
-
CVE CVE-2009-2169 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- 7T Interactive Graphical SCADA System Multiple Security Vulnerabilities
- Adobe Air Multiple Vulnerabilities - December12 (Windows)
- Adobe Acrobat and Reader 'printSeps()' Function Heap Corruption Vulnerability
- Adobe AIR Code Execution and DoS Vulnerabilities Nov13 (Windows)
- Adobe Air Multiple Vulnerabilities June-2012 (Mac OS X)