PT-2008-5062 · Jcomsoft+1 · Jcomsoft Anigif.Ocx+1

Published 2008-08-15 · Updated 2017-09-29 · CVE-2008-3702

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JComSoft AniGIF.ocx versions 1.12 through 2.47 SpeedBit Download Accelerator Plus (DAP) version 8.6

Description The issue is related to multiple stack-based buffer overflows in the Animation GIF ActiveX control. This can be exploited by remote attackers to execute arbitrary code via a long argument to the (1) ReadGIF or (2) ReadGIF2 method.

Recommendations For JComSoft AniGIF.ocx versions 1.12 through 2.47, consider disabling the ReadGIF and ReadGIF2 methods until a patch is available. For SpeedBit Download Accelerator Plus (DAP) version 8.6, restrict the use of the affected ActiveX control to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-3702

Affected Products

Download Accelerator Plus

Jcomsoft Anigif.Ocx

References · 5

• 🔥 https://exploit-db.com/exploits/6216 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3702 · Security Note
• http://securityreason.com/securityalert/4159 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44412 · Note
• http://securityfocus.com/bid/30621 · Note