CVE-2008-4388

The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods.

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

37.72% chance of exploitation in the next 30 days, 99th percentile

Published

2009-01-20

Updated

2024-09-16

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/symantec_appstre…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/16512

Security advisories

• http://www.symantec.com/avcenter/security/Content/2009.01.15.html
• http://www.kb.cert.org/vuls/id/194505
• http://www.securityfocus.com/bid/33247

References

• CVE Record
• NVD entry