CVE-2007-1009

Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password or (2) serial number verification sections from this file.

CVSS v2.0 4.6 MEDIUM

4.6^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-003.txt	Vendor Advisory
http://www.securityfocus.com/bid/22643	Patch
http://securityreason.com/securityalert/2596
http://www.vupen.com/english/advisories/2007/1433
http://www.securityfocus.com/archive/1/466035/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:macrovision:installanywhere:8::enterprise:::::
	cpe:2.3:a:macrovision:installanywhere:8::standard:::::

Information

Published : 2007-04-19 03:19

Updated : 2018-10-16 09:36

NVD link : CVE-2007-1009

Mitre link : CVE-2007-1009

JSON object : View

CWE

NVD-CWE-Other

Products Affected

macrovision

installanywhere

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-003.txt", "name": "http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-003.txt", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/22643", "name": "22643", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://securityreason.com/securityalert/2596", "name": "2596", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2007/1433", "name": "ADV-2007-1433", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/466035/100/0/threaded", "name": "20070416 SYMSA-2007-003 Macrovision InstallAnywhere Password and Serial Number Bypass", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password or (2) serial number verification sections from this file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-1009", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-04-19T10:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:macrovision:installanywhere:8:*:enterprise:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:macrovision:installanywhere:8:*:standard:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-16T16:36Z"}

4.6 /10