Lucene search

MitreCVE-2006-2273

HistoryMay 12, 2006 - 12:02 a.m.

CVE-2006-2273

2006-05-1200:02:00

mitre

web.nvd.nist.gov

verisign

vupdater

install

activex

security

vulnerability

remote execution

cab

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.6

Confidence

High

EPSS

0.043

Percentile

92.3%

JSON

The InstallProduct routine in the Verisign VUpdater.Install (aka i-Nav) ActiveX control does not verify Microsoft Cabinet (.CAB) files, which allows remote attackers to run an arbitrary executable file.

Affected configurations

Nvd

Node

verisigni-nav

VendorProductVersionCPE
verisigni-nav*cpe:2.3:a:verisign:i-nav:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
verisign	i-nav	*	cpe:2.3:a:verisign:i-nav::::::::

References

secunia.com/advisories/20074

securityreason.com/securityalert/878

securitytracker.com/id?1016059

www.osvdb.org/25431

www.securityfocus.com/archive/1/433589/100/0/threaded

www.securityfocus.com/bid/17939

www.vupen.com/english/advisories/2006/1763

www.zerodayinitiative.com/advisories/ZDI-06-014.html

exchange.xforce.ibmcloud.com/vulnerabilities/26375

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.6

Confidence

High

EPSS

0.043

Percentile

92.3%

JSON

Related for CVE-2006-2273