CVE-2009-1064

EUVD-2009-1065 · Published Mar 26, 2009

Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.

Technologies

Orbitdownloader Orbit DownloaderOrbit_Downloader Orbit Downloader

Weaknesses

CWE-94

CVSS scores

v2.05.8AV:N/AC:M/Au:N/C:N/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Stealth

T1190Exploit Public-Facing Application T1027.006HTML Smuggling T1027.009Embedded Payloads T1564.009Resource Forking

References

http://www.waraxe.us/advisory-73.html
https://www.exploit-db.com/exploits/8257
http://www.securityfocus.com/bid/34200
https://exchange.xforce.ibmcloud.com/vulnerabilities/49353

Potentially impacted assets

See if this affects your attack surface