Axis Media Controller 'AxisMediaControlEmb.dll' ActiveX Remote Code Execution Vulnerability

Bugtraq ID:	41078
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 23 2010 12:00AM
Updated:	Jun 23 2010 12:00AM
Credit:	Shinnai
Vulnerable:	Axis Communications Axis Media Control 5.8.5.3
Not Vulnerable:

Axis Media Controller 'AxisMediaControlEmb.dll' ActiveX Remote Code Execution Vulnerability

Axis Media Controller is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application, typically Internet Explorer, that uses the ActiveX control. Successful exploits will compromise the application and possibly the computer. Failed attacks may cause denial-of-service conditions.

Axis Media Controller 5.8.5.3 is vulnerable;; other versions may also be affected.

Axis Media Controller 'AxisMediaControlEmb.dll' ActiveX Remote Code Execution Vulnerability

The following proof-of-concept and exploit are available:

• /data/vulnerabilities/exploits/41078.html

Axis Media Controller 'AxisMediaControlEmb.dll' ActiveX Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Axis Media Controller 'AxisMediaControlEmb.dll' ActiveX Remote Code Execution Vulnerability

References:

• AXIS Media Control Embedded Pointer Highjacking (Shinnai)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)