1CLICK DVD Converter Multiple DLL Loading Arbitrary Code Execution Vulnerabilities
BID:44163
Info
1CLICK DVD Converter Multiple DLL Loading Arbitrary Code Execution Vulnerabilities
| Bugtraq ID: | 44163 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 15 2010 12:00AM |
| Updated: | Oct 15 2010 12:00AM |
| Credit: | anT!-Tr0J4n |
| Vulnerable: |
LG Software Innovation 1CLICK DVD Converter 2.1.7.1 |
| Not Vulnerable: | |
Discussion
1CLICK DVD Converter Multiple DLL Loading Arbitrary Code Execution Vulnerabilities
1CLICK DVD Converter is prone to multiple vulnerabilities that let attackers execute arbitrary code.
An attacker can exploit these issues by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.
LG Software Innovation 1CLICK DVD Converter 2.1.7.1 is vulnerable; other versions may also be affected.
1CLICK DVD Converter is prone to multiple vulnerabilities that let attackers execute arbitrary code.
An attacker can exploit these issues by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.
LG Software Innovation 1CLICK DVD Converter 2.1.7.1 is vulnerable; other versions may also be affected.
Exploit / POC
1CLICK DVD Converter Multiple DLL Loading Arbitrary Code Execution Vulnerabilities
A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.
The following exploit code is available:
A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.
The following exploit code is available:
Solution / Fix
1CLICK DVD Converter Multiple DLL Loading Arbitrary Code Execution Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].