CVE-2012-4177

Published: Aug 7, 2012Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.

Affected (4)

Products: Ubi: Uplay Pc

Ubi

1 product

Uplay Pc

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Ubi Uplay Pc	Up to 2.0.3
Ubi Uplay Pc	Version 2.0.1
Ubi Uplay Pc	Version 2.0.2
Ubi Uplay Pc	Version 2.0

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (10)

http://forums.ubi.com/showthread.php/699940-Uplay-PC-Patch-2-0-4-Security-fix

Source: cve@mitre.org

http://osvdb.org/84402

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2012/Jul/375

Source: cve@mitre.org

http://www.bbc.com/news/technology-19053453

Source: cve@mitre.org

http://www.exploit-db.com/exploits/20321

Source: cve@mitre.org

http://forums.ubi.com/showthread.php/699940-Uplay-PC-Patch-2-0-4-Security-fix