PT-2007-1911 · Gracenote · Gracenote Cddb

Peter Vreugdenhil · Published 2007-04-24 · Updated 2018-10-16 · CVE-2007-0443

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gracenote CDDB versions prior to 20070418

Description The issue is related to multiple buffer overflows in the CDDBControl ActiveX control. This can be exploited by remote attackers to execute arbitrary code via long values for certain Proxy configuration parameters, such as Proxy settings.

Recommendations For versions prior to 20070418, update to a version released after 20070418 to resolve the issue. As a temporary workaround, consider restricting access to the CDDBControl ActiveX control until a patch is available.

Fix

Related Identifiers

CVE-2007-0443

Affected Products

Gracenote Cddb

References · 10

• http://securityfocus.com/bid/23567 · Patch
• http://zerodayinitiative.com/advisories/ZDI-07-021.html · Vendor Advisory
• http://secunia.com/advisories/22924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0443 · Security Note
• http://securityfocus.com/archive/1/466403/100/0/threaded · Note
• http://vupen.com/english/advisories/2007/1475 · Note
• http://osvdb.org/34327 · Note
• http://gracenote.com/corporate/FAQs.html/faqset=update/page=0 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33773 · Note
• http://securitytracker.com/id?1017937 · Note