CVE-2004-2635

An ActiveX control for McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages that use the control's RegQueryValue() method.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://archives.neohapsis.com/archives/ntbugtraq/2004-q2/0026.html	Exploit
http://www.securityfocus.com/bid/10236
http://www.osvdb.org/5713	Patch
http://www.securitytracker.com/alerts/2004/Apr/1009956.html	Exploit
http://secunia.com/advisories/11493	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15994

Configurations

Configuration 1 (hide)

cpe:2.3:a:mcafee:security_installer_control_system:4.0.0.81:*:*:*:*:*:*:*

Information

Published : 2004-12-30 21:00

Updated : 2017-07-19 18:29

NVD link : CVE-2004-2635

Mitre link : CVE-2004-2635

JSON object : View

CWE

NVD-CWE-Other

Products Affected

mcafee

security_installer_control_system

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://archives.neohapsis.com/archives/ntbugtraq/2004-q2/0026.html", "name": "20040425 McAfee VirusScan installer uses insecure ActiveX controls", "tags": ["Exploit"], "refsource": "NTBUGTRAQ"}, {"url": "http://www.securityfocus.com/bid/10236", "name": "10236", "tags": [], "refsource": "BID"}, {"url": "http://www.osvdb.org/5713", "name": "5713", "tags": ["Patch"], "refsource": "OSVDB"}, {"url": "http://www.securitytracker.com/alerts/2004/Apr/1009956.html", "name": "1009956", "tags": ["Exploit"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/11493", "name": "11493", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15994", "name": "mcafee-virusscan-activex-gain-access(15994)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An ActiveX control for McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages that use the control's RegQueryValue() method."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2004-2635", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2004-12-31T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mcafee:security_installer_control_system:4.0.0.81:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-20T01:29Z"}

7.5 /10