CVE-2011-1207
The ActiveBar1 ActiveX control in the Data Dynamics ActiveBar ActiveX controls, as distributed in ActBar.ocx 1.0.6.5 in IBM Rational System Architect 11.4.0.2, 11.4.0.1, and earlier, does not properly restrict the SetLayoutData method, which allows…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The ActiveBar1 ActiveX control in the Data Dynamics ActiveBar ActiveX controls, as distributed in ActBar.ocx 1.0.6.5 in IBM Rational System Architect 11.4.0.2, 11.4.0.1, and earlier, does not properly restrict the SetLayoutData method, which allows remote attackers to execute arbitrary code via a crafted Data argument, a different vulnerability than CVE-2007-3883. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 5.26% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- ibm/rational system architect
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/43399Vendor Advisory
- http://secunia.com/advisories/43474Vendor Advisory
- http://securitytracker.com/id?1025464Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/47643Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2011/1129Vendor Advisory
- https://www.ibm.com/support/docview.wss?uid=swg21497689Patch, Vendor Advisory
- http://secunia.com/advisories/43399Vendor Advisory
- http://secunia.com/advisories/43474Vendor Advisory
- http://securitytracker.com/id?1025464Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/47643Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2011/1129Vendor Advisory
- https://www.ibm.com/support/docview.wss?uid=swg21497689Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.