PT-2008-5592 · Numedia Soft · Nms Dvd Burning Sdk

Nine:Situations:Group · Published 2008-09-30 · Updated 2024-02-14 · CVE-2008-4342

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 version 1.013C and earlier

Description: The issue allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. This can potentially be leveraged for remote code execution by accessing files using hcp:// URLs. It is noted that this issue might only be exploitable in limited environments or non-default browser settings.

Recommendations: For NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 version 1.013C and earlier, consider disabling the EnableLog and LogMessage methods as a temporary workaround until a patch is available. Restrict access to the NMSDVDX.dll file to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-4342

Affected Products

Nms Dvd Burning Sdk

References · 12

• 🔥 http://securityfocus.com/bid/31374 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_numedia_xpl.html · Exploit
• 🔥 https://exploit-db.com/exploits/6491 · Exploit
• 🔥 http://shinnai.net/xplits/TXT_TrWE9AJA8nQpuFsnxBcq · Exploit
• http://secunia.com/advisories/31949 · Vendor Advisory
• http://secunia.com/advisories/31950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4342 · Security Note
• http://secunia.com/advisories/32455 · Vendor Advisory
• http://secunia.com/advisories/31936 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2663 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45330 · Note
• http://securityfocus.com/archive/1/497831/100/0/threaded · Note