CVE-2014-3911

Samsung iPOLiS Device Manager before 1.8.7 allow remote attackers to execute arbitrary code via unspecified values to the (1) Start, (2) ChangeControlLocalName, (3) DeleteDeviceProfile, (4) FrameAdvanceReader, or other unknown method in the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://update.websamsung.net/Tools/iPOLiS%20Device%20Manager/iPOLiS%20Device%20Manager_v1.8.7_setup_Full.zip	Patch
http://www.zerodayinitiative.com/advisories/ZDI-14-167/
http://www.zerodayinitiative.com/advisories/ZDI-14-172/
http://www.zerodayinitiative.com/advisories/ZDI-14-168/
http://www.zerodayinitiative.com/advisories/ZDI-14-171/
http://www.securityfocus.com/bid/67822
http://www.zerodayinitiative.com/advisories/ZDI-14-170/

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:samsung:ipolis_device_manager:*:*:*:*:*:*:*:*

Information

Published : 2014-06-11 07:55

Updated : 2014-06-12 09:24

NVD link : CVE-2014-3911

Mitre link : CVE-2014-3911

JSON object : View

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

Advertisement

Products Affected

samsung

ipolis_device_manager

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://update.websamsung.net/Tools/iPOLiS%20Device%20Manager/iPOLiS%20Device%20Manager_v1.8.7_setup_Full.zip", "name": "http://update.websamsung.net/Tools/iPOLiS%20Device%20Manager/iPOLiS%20Device%20Manager_v1.8.7_setup_Full.zip", "tags": ["Patch"], "refsource": "MISC"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-167/", "name": "http://www.zerodayinitiative.com/advisories/ZDI-14-167/", "tags": [], "refsource": "MISC"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-172/", "name": "http://www.zerodayinitiative.com/advisories/ZDI-14-172/", "tags": [], "refsource": "MISC"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-168/", "name": "http://www.zerodayinitiative.com/advisories/ZDI-14-168/", "tags": [], "refsource": "MISC"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-171/", "name": "http://www.zerodayinitiative.com/advisories/ZDI-14-171/", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/67822", "name": "67822", "tags": [], "refsource": "BID"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-170/", "name": "http://www.zerodayinitiative.com/advisories/ZDI-14-170/", "tags": [], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Samsung iPOLiS Device Manager before 1.8.7 allow remote attackers to execute arbitrary code via unspecified values to the (1) Start, (2) ChangeControlLocalName, (3) DeleteDeviceProfile, (4) FrameAdvanceReader, or other unknown method in the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-94"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-3911", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2014-06-11T14:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:samsung:ipolis_device_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.8.2"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2014-06-12T16:24Z"}