CVE-2007-1009: Medium severity Macrovision InstallAnywhere vulnerability

Published Apr 19, 2007

Updated

Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iapxml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password or (2) serial number verification sections from this file.

Affected Software

2 affected components

Macrovision InstallAnywhere=8

Remediation

Patch Available

http://www.securityfocus.com/bid/22643

Event History

Apr 19, 2007

CVE Published

10:19 AM

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1009?

CVE-2007-1009 is classified as a local privilege escalation vulnerability.

How do I fix CVE-2007-1009?

To mitigate CVE-2007-1009, ensure that you update Macrovision InstallAnywhere to version 8.0.1 or later.

Who is affected by CVE-2007-1009?

CVE-2007-1009 affects users of Macrovision InstallAnywhere Enterprise and Standard versions before 8.0.1.

What causes the vulnerability in CVE-2007-1009?

CVE-2007-1009 occurs due to the absence of integrity protection for the InstallScript.iap_xml configuration file.

Can CVE-2007-1009 be exploited remotely?

No, CVE-2007-1009 requires local access to exploit the vulnerability.