Xvid Avi MBCoding.C Remote Code Execution Vulnerability

Bugtraq ID:	24561
Class:	Design Error
CVE:	CVE-2007-3329
Remote:	Yes
Local:	No
Published:	Jun 20 2007 12:00AM
Updated:	Aug 09 2007 01:04AM
Credit:	Trixter Jack is credited with the discovery of this issue.
Vulnerable:	Xvid Xvid 1.1.2 Gentoo media-libs/xvid 1.1.3
Not Vulnerable:	Xvid Xvid 1.1.3

Xvid Avi MBCoding.C Remote Code Execution Vulnerability

Xvid is prone to a remote code-exexcution vulnerability due to an array-indexing error.

Attackers can exploit this issue to execute arbitrary code on an unsuspecting user's computer.

Xvid 1.1.2 is vulnerable; other versions may also be affected.

Xvid Avi MBCoding.C Remote Code Execution Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a malicious AVI file with the affected application.

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Xvid Avi MBCoding.C Remote Code Execution Vulnerability

Solution:
The vendor released Xvid 1.1.3 to address this issue.


Xvid Xvid 1.1.2

• Xvid xvidcore-1.1.3.tar.gz
  http://downloads.xvid.org/downloads/xvidcore-1.1.3.tar.gz

Xvid Avi MBCoding.C Remote Code Execution Vulnerability

References:

• Changes since 1.1.2: (Xvid)
  
• Xvid Homepage (Xvid)