Design/Logic Flaw

2010-02-1117:30:00

PRIOn knowledge base

www.prio-n.com

8.2 High

AI Score

Confidence

Low

0.104 Low

EPSS

Percentile

95.0%

JSON

The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive’s digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.

CPENameOperatorVersion
panda_activescaneq2.0

CPE	Name	Operator	Version
	panda_activescan	eq	2.0

References

secunia.com/advisories/38485

www.kb.cert.org/vuls/id/869993

www.kb.cert.org/vuls/id/MAPG-7QPKL3

www.securityfocus.com/bid/38067

www.vupen.com/english/advisories/2010/0354

docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008