National Cyber-Alert System

Vulnerability Summary for CVE-2007-4583

Overview

Multiple absolute path traversal vulnerabilities in the nvUtility.Utility.1 ActiveX control in nvUtility.dll 1.0.14.0 in ACTi Network Video Recorder (NVR) SP2 2.0 allow remote attackers to (1) create or overwrite arbitrary files via a full pathname in the first argument to the SaveXMLFile method or (2) delete arbitrary files via a full pathname in the argument to the DeleteXMLFile method.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MILW0RM

Name: 4324

Hyperlink:http://www.milw0rm.com/exploits/4324

External Source: MILW0RM

Name: 4323

Hyperlink:http://www.milw0rm.com/exploits/4323

External Source: OSVDB

Name: 38387

Hyperlink:http://osvdb.org/38387

External Source: OSVDB

Name: 38386

Hyperlink:http://osvdb.org/38386

External Source: XF

Name: actinvr-savexmlfile-file-overwrite(36304)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36304

External Source: XF

Name: actinvr-deletexmlfile-file-overwrite(36303)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36303

External Source: BID

Name: 25465

Hyperlink:http://www.securityfocus.com/bid/25465

External Source: VUPEN

Name: ADV-2007-2993

Hyperlink:http://www.frsirt.com/english/advisories/2007/2993

External Source: SECUNIA

Name: 26622

Hyperlink:http://secunia.com/advisories/26622