|
|
Family: Windows --> Category: infos
Acer LunchApp.APlunch Arbitrary Command Execution Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Checks for Acer LunchApp.APlunch ActiveX control
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote Windows host has an ActiveX control that is allows
arbitrary code execution.
Description :
The remote host contains an ActiveX control from Acer called
LunchApp.APlunch that is reportedly shipped with notebook computers
from that manufacturer and is marked as 'safe for scripting' and 'safe
for initializing from persistent data'. By tricking a user on the
affected host into visiting a specially-crafted web page, a possible hacker
can pass arbitrary commands to the 'Run' method that will be executed
on the remote host subject to the user's rights.
See also :
http://vuln.sg/acerlunchapp-en.html
http://support.acer-euro.com/drivers/utilities.html#APP
Solution :
Run the security patch referenced in the vendor advisory above.
Threat Level:
High / CVSS Base Score : 8.2
(AV:R/AC:H/Au:NR/C:C/I:C/A:C/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
