InterActual Player IAMCE and IAKey Remote Buffer Overflow Vulnerabilities
BID:24919
Info
InterActual Player IAMCE and IAKey Remote Buffer Overflow Vulnerabilities
| Bugtraq ID: | 24919 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-3829 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 16 2007 12:00AM |
| Updated: | Nov 04 2008 02:55AM |
| Credit: | Parvez Anwar is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Roxio CinePlayer 3.2 InterActual Technologies InterActual Player 2.60.12.0717 |
| Not Vulnerable: | |
Discussion
InterActual Player IAMCE and IAKey Remote Buffer Overflow Vulnerabilities
InterActual Player contains multiple ActiveX controls that are prone to buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.
An attacker could exploit these issues by creating a malicious web page that would initialize the affected ActiveX controllers and execute arbitrary code within the context of the user.
Exploiting this issue could allow an attacker to execute arbitrary code.
These issues affect InterActual Player 2.60.12.0717; other versions may be vulnerable as well.
InterActual Player contains multiple ActiveX controls that are prone to buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.
An attacker could exploit these issues by creating a malicious web page that would initialize the affected ActiveX controllers and execute arbitrary code within the context of the user.
Exploiting this issue could allow an attacker to execute arbitrary code.
These issues affect InterActual Player 2.60.12.0717; other versions may be vulnerable as well.
Exploit / POC
InterActual Player IAMCE and IAKey Remote Buffer Overflow Vulnerabilities
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
InterActual Player IAMCE and IAKey Remote Buffer Overflow Vulnerabilities
Solution:
The vendor is reported to be working on a fix. Please refer to the vendor's site for details.
Solution:
The vendor is reported to be working on a fix. Please refer to the vendor's site for details.
References
InterActual Player IAMCE and IAKey Remote Buffer Overflow Vulnerabilities
References:
References:
- interActual Player (interActual Technologies)
- Roxio CinePlayer (Roxio)