CyberLink StreamAuthor Insecure Library Loading Multiple Arbitrary Code Execution Vulnerabilities

Bugtraq ID:	55378
Class:	Input Validation Error
CVE:	CVE-2012-4757
Remote:	Yes
Local:	No
Published:	Sep 03 2012 12:00AM
Updated:	Sep 06 2012 09:19PM
Credit:	Parvez Anwar
Vulnerable:
Not Vulnerable:

CyberLink StreamAuthor Insecure Library Loading Multiple Arbitrary Code Execution Vulnerabilities

CyberLink StreamAuthor is prone to multiple vulnerabilities that lets attackers execute arbitrary code.

Successful exploits will allow the attackers to execute arbitrary code in the context of the user running the affected application.

CyberLink StreamAuthor 4.0 build 3308 is vulnerable; other versions may also be affected.

CyberLink StreamAuthor Insecure Library Loading Multiple Arbitrary Code Execution Vulnerabilities

Attackers can exploit these issues using standard commands.

CyberLink StreamAuthor Insecure Library Loading Multiple Arbitrary Code Execution Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

CyberLink StreamAuthor Insecure Library Loading Multiple Arbitrary Code Execution Vulnerabilities

References:

• Application DLL Load Hijacking (HD Moore)
  
• CyberLink Homepage (CyberLink)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Microsoft Security Advisory 2269637 Released (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• Microsoft Security Advisory (2269637) (Microsoft)