PT-2011-2398 · Videospirit · Videospirit Lite+1

Publicado 2011-01-20 · Atualizado 2017-08-17 · CVE-2011-0499

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VideoSpirit Pro versions 1.6.8.1 and earlier VideoSpirit Lite versions 1.4.0.1 and possibly other versions

Description The issue allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long name attribute.

Recommendations For VideoSpirit Pro version 1.6.8.1 and earlier, consider avoiding the use of .visprj files with long name attributes in valitem elements until a fix is available. For VideoSpirit Lite version 1.4.0.1 and possibly other versions, restrict the processing of .visprj files to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2011-0499

Produtos afetados

Videospirit Lite

Videospirit Pro

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/videospirit_visprj.rb · Exploit
• 🔥 https://exploit-db.com/exploits/15936 · Exploit
• 🔥 https://exploit-db.com/exploits/17153 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0499 · Nota de Segurança
• http://secunia.com/advisories/42876 · Aviso do Fabricante
• http://secunia.com/advisories/42866 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64863 · Nota