CVE-2008-1093 Acresso InstallShield Update Agent does not properly verify the authenticity of Rule Scripts obtained from GetRules.asp web pages on FLEXnet Connect servers, which allows remote man-in-the-middle atta...
HighCVSS 9.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Acresso InstallShield Update Agent does not properly verify the authenticity of Rule Scripts obtained from GetRules.asp web pages on FLEXnet Connect servers, which allows remote man-in-the-middle attackers to execute arbitrary VBScript code via Trojan horse Rules.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| acresso flexnet connect | All versions | No fix listed |
| acresso intallshield update agent | All versions | No fix listed |
References
- 31896 third-party-advisory
- 4268 third-party-advisory
- VU#837092 third-party-advisory us-government-resource
- 20080916 InstallShield Update Agent - Downloads and executes "Rule Scripts" insecurely. mailing-list
- 31204 vdb-entry
- 1020893 vdb-entry
- www.simplicity.net
- ADV-2008-2613 vdb-entry