CVE-2007-4149

Published: Aug 3, 2007Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 does not require authentication for (1) the "LOG." command, which allows remote attackers to create or overwrite arbitrary files; (2) the SETTINGSFILE command, which allows remote attackers to overwrite the ini file, and reconfigure VSAOD or cause a denial of service; or (3) the UNINSTALL command, which allows remote attackers to cause a denial of service (daemon shutdown). NOTE: vector 1 can be leveraged for code execution by writing to a Startup folder.

Affected (1)

Products: Visionsoft: Audit

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Visionsoft Audit	Version 12.4.0.0

References (10)

http://osvdb.org/42462

Source: cve@mitre.org

http://www.portcullis.co.uk/uplds/advisories/vafileover-06-039.txt

Source: cve@mitre.org

Vendor Advisory

http://www.portcullis.co.uk/uplds/advisories/vainifileoverwrite%20-%2006_041.txt

Source: cve@mitre.org

Vendor Advisory

http://www.portcullis.co.uk/uplds/advisories/vauninstall%2006_045.txt

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/25153

Source: cve@mitre.org

http://osvdb.org/42462

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.portcullis.co.uk/uplds/advisories/vafileover-06-039.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.portcullis.co.uk/uplds/advisories/vainifileoverwrite%20-%2006_041.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.portcullis.co.uk/uplds/advisories/vauninstall%2006_045.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/25153

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.