NVD

Id
13405  
Name
CVE-2010-1913  
Description
The default configuration of pluginlicense.ini for the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance, when downloaded from a server operated by Telefonica or possibly other companies, contains an incorrect DNS whitelist that includes the DNS hostnames of home computers of many persons, which allows remote attackers to bypass intended restrictions on ActiveX execution by hosting an ActiveX control on an applicable home web server.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2010-05-12  
Modified Date
2010-05-12  
Seq
2010-1913  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
74175 13405 CVE-2010-1913 http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html  View
74176 13405 CVE-2010-1913 VU#602801  View
74177 13405 CVE-2010-1913 20100507 [Wintercore Research] Consona Products - Multiple vulnerabilities  View
74178 13405 CVE-2010-1913 http://www.wintercore.com/downloads/rootedcon_0day.pdf  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
38285 JVNDB-2010-004070 Consona Live Assistance の SdcWebSecureBase インターフェースの pluginlicense.ini のデフォルト設定における ActiveX 実行に対する制限を回避される脆弱性 Consona Live Assistance、Dynamic Agent および Subscriber Assistance の tgctlcm.dll の SdcWebSecureBase インターフェースの pluginlicense.ini のデフォルト設定は、Telefonica などが運営するサーバからダウンロードされた際、多数のユーザのホームコンピュータ DNS ホスト名を含む間違った DNS のホワイトリストを含むため、ActiveX 実行に対する制限を回避される脆弱性が存在します。 CVE-2010-1913 44493 CVE-2010-1913 13405 9.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-004070.html 2010-05-12 2012-06-26 View