PT-2007-5064 · Roxio+1 · Roxio Cineplayer+3

Publicado 2007-07-17 · Atualizado 2017-07-29 · CVE-2007-3829

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: InterActual Player version 2.60.12.0717 Roxio CinePlayer version 3.2

Description: The issue involves multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved through a long FailURL attribute in the IAMCE ActiveX Control (IAMCE.dll) or a long URLCode attribute in the IAKey ActiveX Control (IAKey.dll).

Recommendations: For InterActual Player version 2.60.12.0717, consider disabling the IAMCE ActiveX Control (IAMCE.dll) to prevent exploitation via the FailURL attribute. For Roxio CinePlayer version 3.2, restrict access to the IAKey ActiveX Control (IAKey.dll) to minimize the risk of exploitation via the URLCode attribute. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2007-3829

Produtos afetados

Iakey Activex Control

Iamce Activex Control

Interactual Player

Roxio Cineplayer

Referências · 10

• http://securityfocus.com/bid/24919 · Nota
• http://osvdb.org/37717 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35422 · Nota
• http://osvdb.org/37718 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3829 · Nota de Segurança
• http://kb.cert.org/vuls/id/916897 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35423 · Nota
• http://kb.cert.org/vuls/id/470913 · Nota
• http://secunia.com/advisories/25739 · Aviso do Fabricante
• http://secunia.com/advisories/25718 · Aviso do Fabricante