Description
The ExecuteExe method in the DVBSExeCall Control ActiveX control 1.0.0.1 in DVBSExeCall.ocx in DATEV Base System (aka Grundpaket Basis) allows remote attackers to execute arbitrary commands via unspecified vectors.
References
- http://sotiriu.de/demos/videos/nso-2010-003.html
- 38415 vdb-entry
- 62564 vdb-entry
- datev-dvbsexecall-command-execution(56530) vdb-entry
- ADV-2010-0474 vdb-entry
- 20100225 NSOADV-2010-003: DATEV ActiveX Control remote command execution mailing-list
- http://sotiriu.de/adv/NSOADV-2010-003.txt
- http://www.datev.de/info-db/1080162
- 38716 third-party-advisory