CVE-2009-0465

Published: Feb 10, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The SaveDoc method in the All_In_The_Box.AllBox ActiveX control in ALL_IN_THE_BOX.OCX in Synactis ALL In-The-Box ActiveX 3 allows remote attackers to create and overwrite arbitrary files via an argument ending in a '\0' character, which bypasses the intended .box filename extension, as demonstrated by a C:\boot.ini\0 argument.

Affected (1)

Products: Synactis: All In The Box.ocx

1 product

All In The Box.ocx

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Synactis All In The Box.ocx	Version 3

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://osvdb.org/51693

Source: cve@mitre.org

http://secunia.com/advisories/33728

Source: cve@mitre.org

Vendor Advisory

http://www.dsecrg.com/pages/vul/show.php?id=62

Source: cve@mitre.org

http://www.securityfocus.com/bid/33535

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2009/0298

Source: cve@mitre.org

https://www.exploit-db.com/exploits/7928

Source: cve@mitre.org

http://osvdb.org/51693

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33728

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.dsecrg.com/pages/vul/show.php?id=62

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/33535

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.vupen.com/english/advisories/2009/0298

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/7928

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.