PT-2007-3656 · Intervideo · Intervideo Home Theater+1

Published 2007-04-27 · Updated 2017-07-29 · CVE-2007-2323

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions InterVideo Home Theater versions 2.1.13.0 through 2.5.13.58

Description The issue concerns multiple buffer overflows in the WinDVDX ActiveX control. This can be exploited by remote attackers to execute arbitrary code via a long string argument to the GetDiscType or AddFileList method.

Recommendations For versions 2.1.13.0 through 2.5.13.58, consider disabling the GetDiscType and AddFileList methods as a temporary workaround until a patch is available. Restrict access to the WinDVDX ActiveX control to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2007-2323

Affected Products

Intervideo Home Theater

Windvdx Activex

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-2323 · Security Note
• http://secunia.com/advisories/24710 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33868 · Note
• http://securityfocus.com/bid/23637 · Note
• http://osvdb.org/34330 · Note