critical9.3Public exploit code
CVE-2007-4061
Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary f…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Nessus Vulnerability Scanner 3.0.6 - ActiveX Command Execution2007-07-27 · remote · windows · Verified
Impact
Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the saveNessusRC method, which writes text specified by the addsetConfig method, possibly related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nessus | Vulnerability Scanner | Version 3.0.6 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/26243
- http://www.nessus.org/news/
- http://www.securityfocus.com/bid/25088
- http://www.vupen.com/english/advisories/2007/2702
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35641
- https://www.exploit-db.com/exploits/4237
- http://secunia.com/advisories/26243
- http://www.nessus.org/news/
- http://www.securityfocus.com/bid/25088
- http://www.vupen.com/english/advisories/2007/2702
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35641
- https://www.exploit-db.com/exploits/4237