CVE-2007-1112

Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes unsafe methods in the (a) AXKLPROD60Lib.KAV60Info (AxKLProd60.dll) and (b) AXKLSYSINFOLib.SysInfo (AxKLSysInfo.dll) ActiveX controls, which allows remote attackers to "download" or delete arbitrary files via crafted arguments to the (1) DeleteFile, (2) StartBatchUploading, (3) StartStrBatchUploading, or (4) StartUploading methods.

Link	Resource
http://www.zerodayinitiative.com/advisories/ZDI-07-014.html	Vendor Advisory
http://www.kaspersky.com/technews?id=203038694	Patch
http://secunia.com/advisories/24778	Patch Vendor Advisory
http://www.securityfocus.com/bid/23345
http://www.securitytracker.com/id?1017884
http://www.securitytracker.com/id?1017885
http://www.vupen.com/english/advisories/2007/1268
https://exchange.xforce.ibmcloud.com/vulnerabilities/33464
http://www.securityfocus.com/archive/1/464882/100/0/threaded

Configuration 1

cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:6.0:*:windows_workstation:*:*:*:*:* cpe:2.3:a:kaspersky_lab:kaspersky_internet_security:6.0:maintenance_pack_2:*:*:*:*:*:*

---

Published : 2007-04-06 12:19

Updated : 2018-10-16 04:36

---

NVD link : CVE-2007-1112

Mitre link : CVE-2007-1112

No products.

CWE-749