CVE-2008-2511

Current Description

Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEventCli.dll in CA Internet Security Suite 2008 allows remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the argument to the SaveToFile method. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: some of these details are obtained from third party information.

Basic Data

PublishedJune 02, 2008
Last ModifiedOctober 11, 2018
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-22
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactCOMPLETE
CVSS 2 - Availability ImpactCOMPLETE
CVSS 2 - Base Score9.3
SeverityHIGH
Exploitability Score8.6
Impact Score10.0
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationCaInternet Security Suite Plus 2008********

Vulnerable Software List

VendorProductVersions
Ca Internet Security Suite Plus 2008 *

References

NameSourceURLTags
http://retrogod.altervista.org/9sg_CA_poc.htmlhttp://retrogod.altervista.org/9sg_CA_poc.htmlMISCExploit
30420http://secunia.com/advisories/30420SECUNIAVendor Advisory
20080528 [NSG_28-5-08] CA Internet Security Suite 2008 (UmxEventCli.dll/SaveToFile()) remote file corruption pochttp://www.securityfocus.com/archive/1/492679/100/0/threadedBUGTRAQ
1020129http://www.securitytracker.com/id?1020129SECTRACK
ADV-2008-1696http://www.vupen.com/english/advisories/2008/1696/referencesVUPEN
internet-security-umxeventcli-file-overwrite(42712)https://exchange.xforce.ibmcloud.com/vulnerabilities/42712XF
5682https://www.exploit-db.com/exploits/5682EXPLOIT-DB