An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed safe for scripting, which allows local users to bypass security protections and read arbitrary files via certain functions.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sitekiosk | Sitekiosk | 4.9.11 (including) | 4.9.11 (including) |
| Sitekiosk | Sitekiosk | 4.9.14 (including) | 4.9.14 (including) |
| Sitekiosk | Sitekiosk | 4.96 (including) | 4.96 (including) |
| Sitekiosk | Sitekiosk | 4.96.0 (including) | 4.96.0 (including) |
| Sitekiosk | Sitekiosk | 4.96.3 (including) | 4.96.3 (including) |
| Sitekiosk | Sitekiosk | 4.97.0 (including) | 4.97.0 (including) |
| Sitekiosk | Sitekiosk | 5.0.19 (including) | 5.0.19 (including) |
| Sitekiosk | Sitekiosk | 5.0.26 (including) | 5.0.26 (including) |
| Sitekiosk | Sitekiosk | 5.0.32 (including) | 5.0.32 (including) |
| Sitekiosk | Sitekiosk | 5.0.35 (including) | 5.0.35 (including) |
| Sitekiosk | Sitekiosk | 5.0.36 (including) | 5.0.36 (including) |
| Sitekiosk | Sitekiosk | 5.0.38 (including) | 5.0.38 (including) |
| Sitekiosk | Sitekiosk | 5.0.41 (including) | 5.0.41 (including) |
| Sitekiosk | Sitekiosk | 5.0.238 (including) | 5.0.238 (including) |
| Sitekiosk | Sitekiosk | 5.0.248 (including) | 5.0.248 (including) |
| Sitekiosk | Sitekiosk | 5.0.264 (including) | 5.0.264 (including) |
| Sitekiosk | Sitekiosk | 5.5.34 (including) | 5.5.34 (including) |
| Sitekiosk | Sitekiosk | 5.5.35 (including) | 5.5.35 (including) |
| Sitekiosk | Sitekiosk | 5.5.36 (including) | 5.5.36 (including) |
| Sitekiosk | Sitekiosk | 5.5.39 (including) | 5.5.39 (including) |
| Sitekiosk | Sitekiosk | 5.5.45 (including) | 5.5.45 (including) |
| Sitekiosk | Sitekiosk | 6.0.14 (including) | 6.0.14 (including) |
| Sitekiosk | Sitekiosk | 6.0.98_final (including) | 6.0.98_final (including) |
| Sitekiosk | Sitekiosk | 6.2.51 (including) | 6.2.51 (including) |
| Sitekiosk | Sitekiosk | 6.5.149 (including) | 6.5.149 (including) |
References
- http://secunia.com/advisories/23253
- http://www.securityfocus.com/archive/1/454185/100/0/threaded
- http://www.securityfocus.com/bid/21567
- http://www.sitekiosk.com/th_support/versions/index.php3?id=39
- http://www.vupen.com/english/advisories/2006/4985
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30878
- http://secunia.com/advisories/23253
- http://www.securityfocus.com/archive/1/454185/100/0/threaded
- http://www.securityfocus.com/bid/21567
- http://www.sitekiosk.com/th_support/versions/index.php3?id=39
- http://www.vupen.com/english/advisories/2006/4985
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30878