CVE-2006-3423

Related Files

Zero Day Initiative Advisory 06-021

Posted Jul 9, 2006

Authored by Tipping Point | Site zerodayinitiative.com

The WebEx Downloader Plug-in suffers from a flaw that exists due to the lack of input validation on various ActiveX/Java control parameters and configuration directives. The "GpcUrlRoot" and "GpcIniFileName" ActiveX/Java control parameters allow an attacker to specify the location of a configuration file containing further control directives. This allows an attacker to transfer arbitrary files and executables to the target. The attacker can then leverage available configuration directives to execute the newly created executables thereby compromising the underlying system.

tags | advisory, java, arbitrary, activex

advisories | CVE-2006-3423

SHA-256 | df97c810e9ba3027f49ff7c049482a9cad0431bc73b56f6b6a9067ce7a985129

Download | Favorite | View