HTTP: Roxio CinePlayer ActiveX Control

This signature detects attempts to use unsafe ActiveX controls in Roxio CinePlayer. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Roxio CinePlayer is prone to a stack-based buffer-overflow vulnerability because it fails to sufficiently check boundaries of user-supplied input before copying it to an insufficiently sized memory buffer. A remote attacker may exploit this issue by enticing victims into opening a malicious HTML document. Exploiting this issue allows the attacker to execute arbitrary code in the context of applications using the affected ActiveX control and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions. Roxio CinePlayer 3.2 is vulnerable; other versions may also be affected.

Affected Products

Roxio cineplayer

References

BugTraq: 23412

CVE: CVE-2007-1559

Short Name

HTTP:STC:ACTIVEX:ROXIO-CINEPL

Severity

Major

Recommended

False

Recommended Action

None

HTTP: Roxio CinePlayer ActiveX Control

Extended Description

Affected Products

References

Found a potential security threat?