HTTP: NCTAudioFile2 ActiveX Vulnerability

This signature detects attempts to exploit a known vulnerability in NCTAudioFile2 ActiveX control. Attackers can create a malicious Web page containing dangerous Active X calls, which if accessed by a victim, can allow the attacker to gain control of the victim's client browser.

Extended Description

NCTsoft NCTAudioFile2 ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer. NCTAudioEditor is a collection of ActiveX controls for manipulating audio data. Numerous audio software products use the vulnerable 'NCTAudioFile2.AudioFile' ActiveX component. NCTAudioStudio 2.7.1, NCTAudioEditor 2.7.1, and NCTDialogicVoice 2.7.1 are affected by this vulnerability; other versions may be affected as well. NOTE: Please see the vulnerable systems section for third-party products that are affected because they depend on this ActiveX control.

Affected Products

Mcfunsoft audio_editor

References

BugTraq: 22196

CVE: CVE-2007-0018

URL: http://www.securityfocus.com/archive/1/457965/30/0/threaded http://www.kb.cert.org/vuls/id/292713

Short Name

HTTP:STC:CLSID:ACTIVEX:NCT-AX

Severity

Major

Recommended

False

Recommended Action

None

HTTP: NCTAudioFile2 ActiveX Vulnerability

Extended Description

Affected Products

References

Found a potential security threat?