Main
Vulnerability Database
Exploits
ID:1140 - Exploit for Unsafe ActiveX method in UUSee and UUSee UUUpgrade ActiveX control - CVE-2008-7168
ID:1140 - Exploit for Unsafe ActiveX method in UUSee and UUSee UUUpgrade ActiveX control - CVE-2008-7168
Published: March 18, 2020
Vulnerability identifier: #VU6167
Vulnerability risk: Critical
CVE-ID: CVE-2008-7168
CWE-ID: CWE-618
Exploitation vector: Remote access
Vulnerable software:
UUSee
UUSee UUUpgrade ActiveX control
UUSee
UUSee UUUpgrade ActiveX control
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of arguments passed to the "Update()" method in UUUpgrade.ocx ActiveX control. A remote attacker can trick the victim to visit a specially crafted website and upload malicious file into arbitrary location on victim's computer.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability was being actively exploited in the wild.
The vulnerability exists due to insufficient validation of arguments passed to the "Update()" method in UUUpgrade.ocx ActiveX control. A remote attacker can trick the victim to visit a specially crafted website and upload malicious file into arbitrary location on victim's computer.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability was being actively exploited in the wild.
Remediation
Install the latest version from vendor's website.