GeoVision LiveAudio ActiveX Control Remote Code Execution Vulnerability

Bugtraq ID:	34115
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Mar 13 2009 12:00AM
Updated:	Mar 13 2009 10:26PM
Credit:	Nine:Situations:Group::trotzkista
Vulnerable:	GeoVision LiveAudio ActiveX Control 7.0
Not Vulnerable:

GeoVision LiveAudio ActiveX Control Remote Code Execution Vulnerability

GeoVision LiveAudio ActiveX Control is prone to a remote code-execution vulnerability. This control is identified by the following CLSID:

814A3C52-B6F7-4AEA-A9BC-7849B9B0ECA8

An attacker can exploit this issue to execute arbitrary code in the context of the application using the vulnerable ActiveX control (typically Internet Explorer).

GeoVision LiveAudio ActiveX Control 7.0 is vulnerable; other versions may also be affected.

GeoVision LiveAudio ActiveX Control Remote Code Execution Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/34115.html

GeoVision LiveAudio ActiveX Control Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GeoVision LiveAudio ActiveX Control Remote Code Execution Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Vendor Homepage (GeoVision)
  
• GeoVision LiveAudio ActiveX Control GetAudioPlayingTime() remote freed-memory ac ([email protected])