PT-2007-5064 · Roxio+1 · Roxio Cineplayer+3

Published 2007-07-17 · Updated 2017-07-29 · CVE-2007-3829

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: InterActual Player version 2.60.12.0717 Roxio CinePlayer version 3.2

Description: The issue involves multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved through a long FailURL attribute in the IAMCE ActiveX Control (IAMCE.dll) or a long URLCode attribute in the IAKey ActiveX Control (IAKey.dll).

Recommendations: For InterActual Player version 2.60.12.0717, consider disabling the IAMCE ActiveX Control (IAMCE.dll) to prevent exploitation via the FailURL attribute. For Roxio CinePlayer version 3.2, restrict access to the IAKey ActiveX Control (IAKey.dll) to minimize the risk of exploitation via the URLCode attribute. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2007-3829

Affected Products

Iakey Activex Control

Iamce Activex Control

Interactual Player

Roxio Cineplayer

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-3829 · Security Note
• http://secunia.com/advisories/25739 · Vendor Advisory
• http://secunia.com/advisories/25718 · Vendor Advisory
• http://securityfocus.com/bid/24919 · Note
• http://osvdb.org/37717 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35422 · Note
• http://osvdb.org/37718 · Note
• http://kb.cert.org/vuls/id/916897 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35423 · Note
• http://kb.cert.org/vuls/id/470913 · Note