CVE-2006-3423

WebEx Downloader ActiveX Control and Java - Remote Code Execution via GpcUrlRoot and GpcIniFileName Controls

Title source: llm

Description

WebEx Downloader ActiveX Control and WebEx Downloader Java before 2.1.0.0 do not validate downloaded components, which allows remote attackers to execute arbitrary code via a website that activates the GpcUrlRoot and GpcIniFileName ActiveX controls to cause the client to download a DLL file.

References (11)

Core 11

Core References

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/2688

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1016446

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20956

Various Sources third-party-advisory x_refsource_iss

http://xforce.iss.net/xforce/alerts/id/226

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/24370

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/439496/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/27040

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/18860

Various Sources x_refsource_confirm

http://www.webex.com/lp/security/ActiveAdv.html?TrackID=123456

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/27039

Vendor Advisory x_refsource_misc

http://www.zerodayinitiative.com/advisories/ZDI-06-021.html

Scores

EPSS 0.0856

EPSS Percentile 94.4%

Details

CWE

CWE-20

Status published

Products (2)

webex_communications/downloader_activexcontrol 2.0.0.7

webex_communications/downloader_java 2.0.0.9

Published Jul 07, 2006

Tracked Since Feb 18, 2026