PT-2009-3410 · Sopcast · Sopcast Sopcore Activex Control

Published 2009-03-04 · Updated 2018-10-10 · CVE-2009-0811

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SopCast SopCore ActiveX control version 3.0.3.501

Description The issue is related to an insecure method in the SopCast SopCore ActiveX control, which allows remote attackers to execute arbitrary programs. This can be achieved by providing an executable file name as an argument to the SetExternalPlayer method.

Recommendations For version 3.0.3.501, consider disabling the SetExternalPlayer method until a patch is available to prevent remote attackers from executing arbitrary programs.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0811

Affected Products

Sopcast Sopcore Activex Control

References · 6

• 🔥 http://securityfocus.com/bid/33920 · Exploit
• 🔥 https://exploit-db.com/exploits/8143 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0811 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48955 · Note
• http://securityfocus.com/archive/1/501252/100/0/threaded · Note
• http://retrogod.altervista.org/9sg_sopcastia.html · Note