9.3crit
CVE-2008-4388in critical feed2 exploits
The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly va…
Published 17 y ago · modified 4 mo ago · JSON
CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
37.7%
percentile 99%
Public exploits
2
Metasploit · Exploit-DB
Summary
The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods.
Exploit prediction (EPSS)
37.72% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- Metasploit exploit/windows/browser/symantec_appstream_unsafe Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute · metasploit exploit, excellent rank · 2009-01-15
- EDB-16512 Symantec AppStream LaunchObj - ActiveX Control Arbitrary File Download and Execute (Metasploit) · remote · 2010-11-24
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- kb.cert.org /vuls/id/194505 · third-party-advisory, x_refsource_CERT-VN, x_transferred
- symantec.com /avcenter/security/Content/2009.01.15.html · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/33247 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id?1021609 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2008-4388
- NVD: CVE-2008-4388
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.