PT-2006-4029 · Gracenote · Gracenote Cddbcontrol Activex Control

Peter Vreugdenhil · Published 2006-06-27 · Updated 2017-07-20 · CVE-2006-3134

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gracenote CDDBControl ActiveX Control (affected versions not specified)

Description The issue is related to a buffer overflow in the Gracenote CDDBControl ActiveX Control, which is used by multiple products that utilize Gracenote CDDB. This allows remote attackers to execute arbitrary code via a long option string.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-3134

Affected Products

Gracenote Cddbcontrol Activex Control

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2006-3134 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-06-019.html · Vendor Advisory
• http://securitytracker.com/id?1016389 · Note
• http://europe.nokia.com/nokia/0%2C%2C93034%2C00.html · Note
• http://vupen.com/english/advisories/2006/2562 · Note
• http://osvdb.org/26874 · Note
• http://vupen.com/english/advisories/2006/2563 · Note
• http://secunia.com/advisories/20861 · Note
• http://secunia.com/advisories/20862 · Note
• http://securityfocus.com/bid/18678 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27416 · Note
• http://kb.cert.org/vuls/id/701121 · Note
• http://gracenote.com/sec062706/SonySecurityNotification.html · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047420.html · Note