// For flags

CVE-2008-1307

KingSoft - 'UpdateOcx2.dll SetUninstallName()' Heap Overflow (PoC)

Severity Score

10.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Heap-based buffer overflow in the KUpdateObj2 Class ActiveX control in UpdateOcx2.dll in Beijing KingSoft Antivirus Online Update Module 2007.12.29.29 allows remote attackers to execute arbitrary code via a long argument to the SetUninstallName method.

Desbordamiento de búfer basado en montículo en el control KUpdateObj2 Class ActiveX de UpdateOcx2.dll en Beijing KingSoft Antivirus Online Update Module 2007.12.29.29 pemrite a atacantes remotos ejecutar código de su elección a través de un argumento largo a el método SetUninstallName.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-03-12 CVE Reserved
  • 2008-03-12 CVE Published
  • 2023-09-21 EPSS Updated
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Kingsoft
Search vendor "Kingsoft"
 Antivirus Online Update Module
Search vendor "Kingsoft" for product "Antivirus Online Update Module"
 2007.12.29.29
Search vendor "Kingsoft" for product "Antivirus Online Update Module" and version "2007.12.29.29"
-
Affected