PT-2006-4972 · Arcsoft · Arcsoft Mms Composer

Collin R. Mulliner + 1 · Publicado 2006-08-14 · Atualizado 2018-10-17 · CVE-2006-4131

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ArcSoft MMS Composer versions 1.5.5.6 and earlier ArcSoft MMS Composer versions 2.0.0.13 and earlier

Description The issue is related to multiple buffer overflows that can be triggered by crafted MMS messages. These overflows occur in the (1) M-Notification.ind, (2) M-Retrieve.conf (Header and Body), or (3) SMIL parsers, allowing remote attackers to cause a denial of service (crash) or execute arbitrary code.

Recommendations For ArcSoft MMS Composer versions 1.5.5.6 and earlier, consider disabling the M-Notification.ind, M-Retrieve.conf, and SMIL parsers until a patch is available. For ArcSoft MMS Composer versions 2.0.0.13 and earlier, consider disabling the M-Notification.ind, M-Retrieve.conf, and SMIL parsers until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-4131

Produtos afetados

Arcsoft Mms Composer

Referências · 12

• 🔥 https://exploit-db.com/exploits/28368 · Exploit
• 🔥 https://exploit-db.com/exploits/2156 · Exploit
• http://mulliner.org/pocketpc/CollinMulliner_defcon14_pocketpcphones.pdf · Nota
• http://securityfocus.com/archive/1/442841/100/0/threaded · Nota
• http://securityfocus.com/bid/19451 · Nota
• http://securityreason.com/securityalert/1387 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28342 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4131 · Nota de Segurança
• http://secunia.com/advisories/21426 · Aviso do Fabricante
• http://arcsoft.com/support/downloads/download_patches/mms.asp · Correção
• http://vupen.com/english/advisories/2006/3261 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048614.html · Nota