Title: Macrovision FLEXnet Connect ActiveX Control Multiple Arbitrary File Download Vulnerabilities
Severity: HIGH
Description:
Macrovision FLEXnet Connect allows users to deliver applications, patches, updates, and messages to computers.
Macrovision FLEXnet Connect ActiveX controls are prone to multiple file-access vulnerabilities:
- An arbitrary-file-download vulnerability affects the 'MVSNClientDownloadManager61Lib.DownloadManager' ActiveX control that can be identified by CLSID: FCED4482-7CCB-4E6F-86C9-DCB22B52843C. Specifically, the issue occurs when executing a scheduled job. The ActiveX control allows attackers to specify arbitrary filenames to jobs using the 'AddFile()' method. When the application calls the 'RunScheduledJobs()' method, the attacker-specified file is downloaded onto the affected computer.
- An arbitrary-file-download vulnerability affects the 'isusweb.dll' ActiveX control that can be identified by CLSID: 1DF951B1-8D40-4894-A04C-66AD824A0EEF. The vulnerability occurs because the ActiveX control handles file downloads in an insecure manner, allowing attackers to download and execute arbitrary files. The 'DownloadAndExecute()' method of the control is affected.
An attacker can exploit these issues by enticing an unsuspecting victim to view a malicious webpage. The victim may be required to further interact with the application to trigger one of these issues.
Successful exploits will allow remote attackers to download files from arbitrary locations to the affected computer.
Affected Products:
- Macrovision FLEXnet Connect
References:
- Macrovision: FLEXnet Connect Homepage
- Microsoft: Microsoft Knowledge Base Article 240797
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
