Executive Summary
Summary | |
---|---|
Title | InterActual Player IAMCE ActiveX control stack buffer overflow |
Informations | |||
---|---|---|---|
Name | VU#916897 | First vendor Publication | 2007-08-13 |
Vendor | VU-CERT | Last vendor Modification | 2007-08-13 |
Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Vulnerability Note VU#916897InterActual Player IAMCE ActiveX control stack buffer overflowOverviewThe InterActual Player IAMCE ActiveX control contains a stack buffer overflow, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.I. DescriptionInterActual Player is a video DVD playing application for Windows systems. InterActual Player was formerly known as InterActual PCFriendly. The InterActual Player software provides several ActiveX controls. The IAMCE ActiveX control, which is provided by IAMCE.dll, contains a stack buffer overflow vulnerability.II. ImpactBy convincing a user to view a specially crafted HTML document (e.g., a web page, an HTML email message, or an HTML email attachment), an attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause the web browser to crash.III. SolutionWe are currently unaware of a practical solution to this problem. Please consider the following workaroundsDisable the IAMCE ActiveX control in Internet Explorer
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{8B67B37E-1AE2-4b99-B8CF-55AF4D58DF0D}] "Compatibility Flags"=dword:00000400 Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this and other ActiveX vulnerabilities. Instructions for disabling ActiveX in the Internet Zone can be found in the Securing Your Web Browser document. Systems Affected
Referenceshttp://www.cert.org/tech_tips/securing_browser/#Internet_Explorer This vulnerability was reported by Will Dormann of the CERT/CC. It was also independently discovered by Parvez Anwar. This document was written by Will Dormann.
|
Original Source
Url : http://www.kb.cert.org/vuls/id/916897 |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 | |
Application | 1 |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
37718 | IAMCE ActiveX (IAMCE.dll) FailURL Attribute Overflow |
37717 | IAKey ActiveX (IAKey.dll) URLCode Attribute Overflow |