SecurityvulnsSECURITYVULNS:DOC:23197[DSECRG-09-065] TVUPlayer PlayerOcx.ocx ActiveX - Insecure method
ActiveX component contains insecure method that can overwrite any file in system
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-065
Application: TVUPlayer
Versions Affected: Tested on v2.4.9beta1[build1797]
Vendor URL: www.tvunetworks.com
Bugs: insecure method, File overwriting
Exploits: YES
Reported: 25.11.2009
Second report 11.01.2010
Vendor response: none
Date of Public Advisory: 03.02.2010
CVE-number:
Author: Evdokimov Dmitriy
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
Description
TVUPlayer contains ActiveX component PlayerOcx ( file PlayerOcx.ocx) Lib GUID: {18E6ED0D-08D1-4ED5-8771-E72B4E6EFFD8}
which is contains insecure method that can overwrite any file in system.
Details
Detail can be found in official advisory
http://dsecrg.com/pages/vul/show.php?id=165
Fix Information
There is no official fix from vendor because vendor did not give any
response for 2 times.
As an alternative - user can set killbit on this component.
References
http://dsecrg.com/pages/vul/show.php?id=165
About
Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk
analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on application and
database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
Contact: research [at] dsecrg [dot] com
http://www.dsecrg.com
Polyakov Alexandr. PCI QSA.
Head of security audit department
Head of Digital Security Research Group
DIGITAL SECURITY
phone: +7 812 703 1547
+7 812 430 9130
e-mail: [email protected]
www.dsec.ru
www.dsecrg.com
www.pcidss.ru