H+H Software Virtual CD VC9API.DLL ActiveX Remote Command Execution Vulnerability

Bugtraq ID:	24087
Class:	Design Error
CVE:	CVE-2007-2853
Remote:	Yes
Local:	No
Published:	May 21 2007 12:00AM
Updated:	May 07 2015 05:38PM
Credit:	Discovered by rgod.
Vulnerable:	H+H Software Virtual CD 9.0.0.2
Not Vulnerable:

H+H Software Virtual CD VC9API.DLL ActiveX Remote Command Execution Vulnerability

Virtual CD 'vd9api.dll' ActiveX control is prone to a remote command-execution vulnerability.

A successful attack can allow an attacker to gain unauthorized remote access to a vulnerable computer in the context of the affected user.

Virtual CD 9.0.0.2 is vulnerable to this issue; other versions may be affected as well.

H+H Software Virtual CD VC9API.DLL ActiveX Remote Command Execution Vulnerability

An exploit is not required.

• /data/vulnerabilities/exploits/virtualcd_poc.txt

H+H Software Virtual CD VC9API.DLL ActiveX Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

H+H Software Virtual CD VC9API.DLL ActiveX Remote Command Execution Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Virtual CD (H+H Software)