|
|
|
|
| |
Credit:
The information has been provided by Diego Juarez.
The original article can be found at: http://www.coresecurity.com/content/winds3d-viewer-advisory
|
| |
Vulnerable Systems:
* Awingsoft Awakening Winds3D Viewer version 3.5.0.0 and prior
Workaround:
A possible mitigation action would be to enable MIME type filtering in your IDS/proxies and block Winds3D traffic: 'application/x-awingsoft-winds3d'. As a workaround, vulnerable users can also avoid this flaw by disabling the Winds3D Plugin in their web browsers:
*Mozilla Firefox*
~ . Go to the Tools menu, and select Options...
~ . Click on the Main tab
~ . Click on the Manage Add-ons...
~ . Disable Winds3D Plugin
*Internet Explorer*
~ . Set the kill bit for control *17A54E7D-A9D4-11D8-9552-00E04CB09903* (as explained in http://support.microsoft.com/kb/240797).
*Opera*
~ . Browse opera:plugins
~ . Look for "Winds3D Plugin for Mozilla"
~ . Delete the associated file.
CVE Information:
CVE-2009-2386
Disclosure Timeline:
2009-05-19: Awingsoft notified of the vulnerability (no reply received)
2009-06-29: 2nd notice (no reply received)
2009-07-08: Published advisory CORE-2009-0519 as "User release".
|
|
|
|
|
