SoftCab Sound Converter 'sndConverter.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability

Bugtraq ID:	41434
Class:	Input Validation Error
CVE:	CVE-2009-4453
Remote:	Yes
Local:	No
Published:	Dec 25 2009 12:00AM
Updated:	Dec 25 2009 12:00AM
Credit:	ThE g0bL!N
Vulnerable:	SoftCab Sound Converter ActiveX 1.2
Not Vulnerable:

SoftCab Sound Converter 'sndConverter.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability

SoftCab Sound Converter ActiveX control is prone to an arbitrary-file-overwrite vulnerability.

Attackers can overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

Sound Converter ActiveX 1.2 is vulnerable; other versions may also be affected.

SoftCab Sound Converter 'sndConverter.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/41434.html

SoftCab Sound Converter 'sndConverter.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SoftCab Sound Converter 'sndConverter.ocx' ActiveX Control Arbitrary File Overwrite Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Sound Converter ActiveX - Homepage (SoftCab)