PT-2011-2398 · Videospirit · Videospirit Lite+1

Published 2011-01-20 · Updated 2017-08-17 · CVE-2011-0499

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VideoSpirit Pro versions 1.6.8.1 and earlier VideoSpirit Lite versions 1.4.0.1 and possibly other versions

Description The issue allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long name attribute.

Recommendations For VideoSpirit Pro version 1.6.8.1 and earlier, consider avoiding the use of .visprj files with long name attributes in valitem elements until a fix is available. For VideoSpirit Lite version 1.4.0.1 and possibly other versions, restrict the processing of .visprj files to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-0499

Affected Products

Videospirit Lite

Videospirit Pro

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/videospirit_visprj.rb · Exploit
• 🔥 https://exploit-db.com/exploits/15936 · Exploit
• 🔥 https://exploit-db.com/exploits/17153 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0499 · Security Note
• http://secunia.com/advisories/42876 · Vendor Advisory
• http://secunia.com/advisories/42866 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64863 · Note