Unscored severity · published Feb 11, 2010
CVE-2009-3735
The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located…
–
CVSS
5.7%
EPSS
No
On KEV
Description
The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.7% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Panda Activescan · Panda
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3735
Vendor Advisory
http://secunia.com/advisories/38485
US Government Resource
http://www.kb.cert.org/vuls/id/869993
www.kb.cert.org
http://www.kb.cert.org/vuls/id/MAPG-7QPKL3
www.securityfocus.com
http://www.securityfocus.com/bid/38067
Vendor Advisory
http://www.vupen.com/english/advisories/2010/0354
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008
More from Panda Activescan
–
CVE-2008-3155
Stack-based buffer overflow in the ActiveX control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attackers to cause a denial of service (crash) or execute…
–
CVE-2008-3156
The ActiveScan ActiveX Control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attackers to download and execute arbitrary cabinet (CAB) files via unspecified URLs…
–
CVE-2007-1670
Panda Software Antivirus before 20070402 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous…
–
CVE-2006-4295
Cross-site scripting (XSS) vulnerability in ascan_6.asp in Panda ActiveScan 5.53.00 allows remote attackers to inject arbitrary web script or HTML via the email parameter
–
CVE-2005-3922
Heap-based buffer overflow in pskcmp.dll in Panda Software Antivirus library allows remote attackers to execute arbitrary code via a crafted ZOO archive