CDNetworks Nefficient Download 'NeffyLauncher.dll' ActiveX Control Multiple Vulnerabilities

Bugtraq ID:	28666
Class:	Input Validation Error
CVE:	CVE-2008-1886 CVE-2008-1885
Remote:	Yes
Local:	No
Published:	Apr 07 2008 12:00AM
Updated:	Jul 06 2016 02:17PM
Credit:	Simon Ryeo
Vulnerable:	CDNetworks NeffyLauncher.dll 1.0.5 CDNetworks Nefficient Download 0
Not Vulnerable:

CDNetworks Nefficient Download 'NeffyLauncher.dll' ActiveX Control Multiple Vulnerabilities

CDNetworks Nefficient Download is prone to an arbitrary-file-upload vulnerability and an authentication-bypass vulnerability that affect the 'NeffyLauncher.dll' ActiveX control library.

Attackers can leverage these issues to upload malicious data to an arbitrary location on a user's computer or to bypass keycode authentication security. Successful attacks will compromise affected computers.

NeffyLauncher.dll 1.0.5 is vulnerable.

CDNetworks Nefficient Download 'NeffyLauncher.dll' ActiveX Control Multiple Vulnerabilities

Solution:
The vendor released a patch to address these issues. Please contact the vendor for information on how to obtain and apply the patch.

CDNetworks Nefficient Download 'NeffyLauncher.dll' ActiveX Control Multiple Vulnerabilities

References:

• Vendor Homepage (CDNetworks)
  
• CDNetworks Nefficient Download(NeffyLauncher.dll) Vulnerabilities ("Simon Ryeo" )