InterActual Player ITIRecorder.MicRecorder ActiveX Control Remote Buffer Overflow Vulnerability

Bugtraq ID:	19205
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 28 2006 12:00AM
Updated:	Jul 28 2006 09:02PM
Credit:	Parvez Anwar is credited with the discovery of this vulnerability.
Vulnerable:	InterActual Technologies InterActual Player 2.60.12 .0201
Not Vulnerable:	InterActual Technologies InterActual Player 2.6

InterActual Player ITIRecorder.MicRecorder ActiveX Control Remote Buffer Overflow Vulnerability

InterActual Player ITIRecorder.MicRecorder ActiveX control is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

An attacker could exploit this issue by creating a malicious web page that would initialize the ActiveX controller and execute arbitrary code within the context of the user.

This issue could allow an attacker to execute arbitrary code.

This issue affects versions 2.60.12.0201 with IARECORD.DLL (1.07.11.0620). Other versions may be vulnerable as well.

InterActual Player ITIRecorder.MicRecorder ActiveX Control Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

InterActual Player ITIRecorder.MicRecorder ActiveX Control Remote Buffer Overflow Vulnerability

Solution:
The vendor has released version 2.6 to address this issue. Please refer to the product's home page for more details.

InterActual Player ITIRecorder.MicRecorder ActiveX Control Remote Buffer Overflow Vulnerability

References:

• interActual Player (interActual Technologies)