CVE Vulnerability

CVE-2007-1009

Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password or (2) serial number verification sections from this file.

4.6 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

References
Link Resource
http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-003.txt Vendor Advisory
http://www.securityfocus.com/bid/22643 Patch
http://securityreason.com/securityalert/2596
http://www.vupen.com/english/advisories/2007/1433
http://www.securityfocus.com/archive/1/466035/100/0/threaded
Configurations

Configuration 1

cpe:2.3:a:macrovision:installanywhere:8:*:standard:*:*:*:*:*
cpe:2.3:a:macrovision:installanywhere:8:*:enterprise:*:*:*:*:*
Information

Published : 2007-04-19 10:19

Updated : 2018-10-16 04:36

NVD link : CVE-2007-1009

Mitre link : CVE-2007-1009

Products Affected
No products.
CWE
NVD-CWE-Other