CVEvulnerability
CVE-2009-4606
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2010-01-13
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
South River Technologies WebDrive 9.02 build 2232 installs the WebDrive Service without a security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.
Affected configurations
• south river technologies webdrive 9.02
Related
Weakness · not in database (1)
References
- http://osvdb.org/59080 osvdb.org
- http://retrogod.altervista.org/9sg_south_river_priv.html retrogod.altervista.org
- http://secunia.com/advisories/37083 Vendor Advisory
- http://www.securityfocus.com/archive/1/507323/100/0/threaded www.securityfocus.com
- http://www.vupen.com/english/advisories/2009/2994 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53885 exchange.xforce.ibmcloud.com
- http://osvdb.org/59080 osvdb.org
- http://retrogod.altervista.org/9sg_south_river_priv.html retrogod.altervista.org
- http://secunia.com/advisories/37083 Vendor Advisory
- http://www.securityfocus.com/archive/1/507323/100/0/threaded www.securityfocus.com
- http://www.vupen.com/english/advisories/2009/2994 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53885 exchange.xforce.ibmcloud.com