PT-2008-3161 · Lead Technologies · Leadtools Multimedia Toolkit

Published 2008-04-01 · Updated 2017-08-08 · CVE-2008-1605

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LEADTOOLS Multimedia Toolkit versions 15.1.0.17 and earlier

Description The issue allows attackers to overwrite arbitrary files via the SaveSettingsToFile method in the ltmmCaptureCtrl, ltmmConvertCtrl, and ltmmPlayCtrl ActiveX controls.

Recommendations For versions 15.1.0.17 and earlier, consider disabling the SaveSettingsToFile method until a patch is available to prevent arbitrary file overwrites. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1605

Affected Products

Leadtools Multimedia Toolkit

References · 7

• 🔥 http://shinnai.altervista.org/xplits/TXT_lyyELAFI8pOPu2p7N6cq.html · Exploit
• 🔥 https://exploit-db.com/exploits/31534 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1605 · Security Note
• http://secunia.com/advisories/29538 · Vendor Advisory
• http://securityfocus.com/bid/28442 · Note
• http://shinnai.altervista.org/index.php?mod=02_Forum&group=Security&argument=Remote_performed_exploits&topic=1206434746.ff.php&page=last · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41467 · Note