CVE-2010-1911 Security feature bypass in n/a
Man-in-the-middle attackers can bypass site-locking restrictions in Consona ActiveX controls via DNS hijacking to execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2010-1911?
CVE-2010-1911 is a critical vulnerability in n/a, published on 11 May 2010. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a DNS hijacking attack.
Weakness: CWE-310
Which versions are affected by CVE-2010-1911?
It affects 3 products.
Products include Consona Consona Dynamic Agent, Consona Consona Live Assistance, Consona Consona Subscriber Assistance.
How do I fix CVE-2010-1911?
No fix has been published for CVE-2010-1911 yet. Limit exposure of the affected software until one is available.
Is CVE-2010-1911 being exploited?
There is no known exploitation of CVE-2010-1911 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h5c2-wmhg-q46m.