PT-2007-4672 · Nct · Nctaudioeditor+2

Shinnai · Published 2007-06-26 · Updated 2017-10-11 · CVE-2007-3400

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NCTAudioEditor2 version 2.6.2.157 NCTAudioEditor versions 2.7 and earlier NCTAudioStudio versions 2.7 and earlier

Description The issue allows remote attackers to overwrite arbitrary files. This is achieved via the CreateFile method in the NCTAudioEditor2 ActiveX control.

Recommendations For NCTAudioEditor2 version 2.6.2.157, consider disabling the CreateFile method until a patch is available. For NCTAudioEditor versions 2.7 and earlier, restrict access to the NCTAudioEditor2 ActiveX control to minimize the risk of exploitation. For NCTAudioStudio versions 2.7 and earlier, avoid using the CreateFile method in the affected ActiveX control until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-3400

Affected Products

Nctaudioeditor

Nctaudioeditor2

Nctaudiostudio

References · 7

• 🔥 http://securityfocus.com/bid/24613 · Exploit
• 🔥 https://exploit-db.com/exploits/4101 · Exploit
• http://vupen.com/english/advisories/2007/2351 · Vendor Advisory
• http://secunia.com/advisories/25825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3400 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35018 · Note
• http://osvdb.org/37674 · Note