CVE-2008-1786 Code injection in n/a
Remote attackers can execute arbitrary code via crafted arguments in the DSM gui_cm_ctrls ActiveX control, requiring user interaction to trigger.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2008-1786?
CVE-2008-1786 is a critical code injection vulnerability in n/a, published on 16 Apr 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5, Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2; and Desktop and Server Management r11.1 through r11.2 C2 allows remote attackers to execute arbitrary code via crafted function arguments.
Weakness: CWE-94
Which versions are affected by CVE-2008-1786?
It affects 7 products.
Products include Computer Associates Arcserve Backup Laptops and Desktops, Computer Associates Desktop and Server Management, Computer Associates Desktop Management Suite, Computer Associates Unicenter Asset Management, Computer Associates Unicenter Desktop Management Bundle, Computer Associates Unicenter Remote Control and 1 more.
How do I fix CVE-2008-1786?
No fix has been published for CVE-2008-1786 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2008-1786 being exploited?
There is no known exploitation of CVE-2008-1786 in the wild and no public exploit code.
Sources
Also known as GHSA-x64v-3g63-2ccm.