CVE-2007-1879 in Internet Security
Summary
by MITRE
The StartUploading function in KL.SysInfo ActiveX control (AxKLSysInfo.dll) in Kaspersky Anti-Virus 6.0 and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows remote attackers to read arbitrary files by triggering an outbound anonymous FTP session that invokes the PUT command. NOTE: this issue might be related to CVE-2007-1112.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/17/2019
The vulnerability identified as CVE-2007-1879 represents a critical security flaw within the Kaspersky Anti-Virus 6.0 and Internet Security 6.0 software suite, specifically affecting versions prior to Maintenance Pack 2 build 6.0.2.614. This issue resides within the KL.SysInfo ActiveX control, more precisely in the StartUploading function of the AxKLSysInfo.dll component. The vulnerability manifests through a dangerous interaction between the ActiveX control and anonymous FTP sessions, creating a pathway for remote attackers to exploit the system. The flaw operates by leveraging the control's ability to initiate outbound FTP connections, which can be manipulated to execute unauthorized file operations. This vulnerability falls under the category of insecure direct object reference and improper input validation, as it allows arbitrary file access through a controlled interface that should otherwise be restricted.
The technical implementation of this vulnerability exploits the design flaw in how the StartUploading function handles FTP communication within the ActiveX control. When an attacker triggers the vulnerable function, it initiates an anonymous FTP session that can execute the PUT command, effectively allowing the attacker to upload files to a remote FTP server. However, the more dangerous aspect occurs when the control is configured to accept user input that specifies file paths, enabling attackers to read arbitrary files from the local system. The vulnerability demonstrates a clear lack of proper access control and input sanitization, as the function does not validate or restrict the file paths that can be accessed through the FTP mechanism. This type of vulnerability is categorized as CWE-22, which describes improper limitation of a pathname to a restricted directory, and also aligns with CWE-73, which covers improper control of filename for file access. The attack vector is particularly concerning because it operates through an ActiveX control that is typically deployed in web browsers, making it accessible to remote attackers through web-based exploitation techniques.
The operational impact of this vulnerability extends beyond simple unauthorized file access, as it provides attackers with the capability to exfiltrate sensitive data from infected systems. The exploitation process allows adversaries to read files that should normally be protected from unauthorized access, potentially including configuration files, system logs, user data, or even critical security-related information that could be used for further attacks. This vulnerability directly impacts the security posture of systems running affected Kaspersky products, as it undermines the fundamental security assumptions that users rely upon when deploying anti-virus protection. The issue is particularly dangerous because it operates within a security tool itself, creating a scenario where the very software designed to protect systems becomes a vector for compromise. The vulnerability's potential for lateral movement and information gathering makes it a valuable target for attackers seeking to establish persistent access or gather intelligence about the compromised environment. This type of vulnerability is commonly classified under the ATT&CK framework as T1059.007 for Windows Command and Scripting Interpreter and T1566.001 for Phishing, as it can be used to execute malicious commands and facilitate initial access through web-based attacks.
Mitigation strategies for this vulnerability should focus on immediate patching and configuration changes to prevent exploitation. Organizations should prioritize updating to Kaspersky Anti-Virus 6.0 Maintenance Pack 2 build 6.0.2.614 or later versions that contain the necessary security fixes. In the interim, administrators should consider disabling ActiveX controls in web browsers, particularly those from third-party vendors, and implementing network-level restrictions to prevent outbound FTP connections from potentially compromised systems. Additionally, the principle of least privilege should be enforced by ensuring that the ActiveX control operates with minimal necessary permissions and that file access restrictions are properly configured. Security monitoring should be enhanced to detect unusual FTP activity patterns and unauthorized file access attempts. The vulnerability also highlights the importance of proper input validation and access control mechanisms within ActiveX controls, emphasizing that all external inputs should be strictly validated before being processed by security-related components. Network segmentation and application whitelisting can provide additional defense-in-depth measures to limit the potential impact of such vulnerabilities. The remediation process should also include comprehensive security assessments to identify other potentially vulnerable ActiveX controls or similar components that may present similar risks.