vendor:
Comodo AntiVirus
by:
Krystian Kloskowski
9.3
CVSS
HIGH
Remote Command Execution
78
CWE
Product Name: Comodo AntiVirus
Affected Version From: 2
Affected Version To: 2
Patch Exists: Yes
Related CWE: N/A
CPE: a:comodo:comodo_antivirus:2.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Microsoft Internet Explorer 6
2008
Comodo AntiVirus 2.0 ExecuteStr() 0day Remote Command Execution Exploit
This exploit allows remote attackers to execute arbitrary commands on vulnerable installations of Comodo AntiVirus 2.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ExecuteStr() method of the vulnerable ActiveX control. By passing a malicious command to the ExecuteStr() method, an attacker can execute arbitrary commands on the vulnerable system.
Mitigation:
Upgrade to the latest version of Comodo AntiVirus 2.0
