CVE:CVE-2007-1112
CNNVD:CNNVD-200704-089
Kaspersky Antivirus是非常流行的杀毒软件。
Kaspersky AntiVirus SysInfo ActiveX控件实现上存在漏洞，恶意网站可能利用此漏洞非授权访问用户系统文件。
Kaspersky AntiVirus的以下ActiveX控件：
  ProgID：KL.SysInfo 
  Clsid：BA61606B-258C-4021-AD27-E07A3F3B91DB 
  文件：C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\AxKLSysInfo.dll 
  版本：5.0.5.0 
这个控件的StartUploading方式允许恶意的Web脚本执行匿名FTP传输，泄露用户机器上的任意文件。
此外，AxKLProd60.dll控件(CLSID：D9EC22E7-1A86-4F7C-8940-0303AE5D6756)也存在类似的漏洞。可通过以下方式利用这些控件中的漏洞：
    Function DeleteFile (
        ByVal strFileName As String
    )
    Function StartBatchUploading (
        ByVal arrFiles As Variant ,
        ByVal strFTPAddress As String ,
        ByVal strFTPUploadPath As String
    ) As Long
    Function StartStrBatchUploading (
        ByVal strFiles As String ,
        ByVal strFTPAddress As String ,
        ByVal strFTPUploadPath As String
    ) As Long
    Function StartUploading (
        ByVal strFilePath As String ,
        ByVal strFTPAddress As String ,
        ByVal strFTPUploadPath As String
    ) As Long
solution:Upgrade kaspersky_lab kaspersky_anti-virus to a higher version than 6.0,and avoid the version 6.0; Upgrade kaspersky_lab kaspersky_internet_security to a higher version than 6.0:maintenance_pack_2,and avoid the version 6.0:maintenance_pack_2