Description
The InstallProduct routine in the Verisign VUpdater.Install (aka i-Nav) ActiveX control does not verify Microsoft Cabinet (.CAB) files, which allows remote attackers to run an arbitrary executable file.
References
- 1016059 vdb-entry
- 25431 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-06-014.html
- ADV-2006-1763 vdb-entry
- 20074 third-party-advisory
- verisign-inav-activex-code-execution(26375) vdb-entry
- 20060510 ZDI-06-014: Verisign I-Nav ActiveX Control Code Execution Vulnerability mailing-list
- 878 third-party-advisory
- 17939 vdb-entry