CVE		CVE-2009-0194
Status		UNKNOWN
Description		The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."
Severity		High
CVSS score		9,3
CVSS vector		(AV:N/AC:M/Au:N/C:C/I:C/A:C)
Phase		ASSIGNED (13.05.2009)
NVD:		http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0194
References		BID : 34858
		BUGTRAQ : 20090507 Secunia Research: Garmin Communicator Plug-In Domain Locking Security Bypass
		MISC : http://secunia.com/secunia_research/2009-16/
		OSVDB : 54258
		SECTRACK : 1022173
		SECUNIA : 34326
		XF : communicator-domain-security-bypass(50360)
SecurityVulns:		Garmin GPS navigator ActiveX unauthorized access