CVE-2007-6331 Absolute path traversal vulnerability in the HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP Info Center (hpinfocenter.exe) 1.0.1.1 in HP Quick Launch Button (QLBCTRL.exe,....
HighCVSS 9.3
EPSS 30.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Absolute path traversal vulnerability in the HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP Info Center (hpinfocenter.exe) 1.0.1.1 in HP Quick Launch Button (QLBCTRL.exe, aka QLB) 6.3 and earlier allows remote attackers to execute arbitrary programs via the first argument to the LaunchApp method. NOTE: only a user-assisted attack is possible on Windows Vista.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HP Inc info center | = 1.0.1.1 | No fix listed |
| HP Inc quick launch button | <= 6.3 | No fix listed |
References
- SSRT071502 vendor-advisory
- 28055 third-party-advisory vendor-advisory
- 1019086 vdb-entry
- www.anspi.pl
- 20071211 HP notebooks remote code execution vulnerability (multiple series) mailing-list
- 26823 exploit vdb-entry
- ADV-2007-4192 vdb-entry
- hpinfo-hpinfo-command-execution(38991) vdb-entry
- 4720 exploit