CVE-2009-0194

Related Files

Garmin Communicator Plug-In Domain Locking Security Bypass

Posted May 7, 2009

Authored by Dyon Balding | Site secunia.com

Secunia Research has discovered a vulnerability in Garmin Communicator Plug-In, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to a synchronisation error in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control (npGarmin.dll). This can be exploited to bypass the domain locking and dialog box presented to the user asking for confirmation that the untrusted site may access private data. Successful exploitation allows full access (such as deleting data, retrieving personal information, or installing firmware updates) to any Garmin GPS products connected to the user's system. Garmin Communicator Plug-In (npGarmin.dll) version 2.6.4.0 is affected.

tags | advisory, activex

advisories | CVE-2009-0194

SHA-256 | d2f086ac3f174a9241e5c568f24970ed3a5b1893adb4e0b56c252fa22c46ae09

Download | Favorite | View