CVE-2007-1009

MEDIUM 4.6CVE-2007-1009 · Published 19/04/2007 · updated 16/06/2026

In short

CVE-2007-1009 is a MEDIUM (CVSS 4.6) vulnerability affecting installanywhere (macrovision).
Chance of exploitation in the next 30 days (EPSS): 0.32%, higher than 24.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
installanywhere macrovision	`= 8`	No fix yet

Description

Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password or (2) serial number verification sections from this file.

References

securityreason.com/securityalert/2596
securityfocus.com/archive/1/466035/100/0/threaded
securityfocus.com/bid/22643 · Patch
symantec.com/content/en/us/enterprise/research/SYMSA-2007-003.txt · Vendor Advisory
vupen.com/english/advisories/2007/1433

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free