Vulnerability CVE-2007-0018


Published: 2007-01-24   Modified: 2012-02-12

Description:
Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: the products include (1) NCTsoft NCTAudioStudio, NCTAudioEditor, and NCTDialogicVoice; (2) Magic Audio Recorder, Music Editor, and Audio Converter; (3) Aurora Media Workshop; DB Audio Mixer And Editor; (4) J. Hepple Products including Fx Audio Editor and others; (5) EXPStudio Audio Editor; (6) iMesh; (7) Quikscribe; (8) RMBSoft AudioConvert and SoundEdit Pro 2.1; (9) CDBurnerXP; (10) Code-it Software Wave MP3 Editor and aBasic Editor; (11) Movavi VideoMessage, DVD to iPod, and others; (12) SoftDiv Software Dexster, iVideoMAX, and others; (13) Sienzo Digital Music Mentor (DMM); (14) MP3 Normalizer; (15) Roemer Software FREE and Easy Hi-Q Recorder, and Easy Hi-Q Converter; (16) Audio Edit Magic; (17) Joshua Video and Audio Converter; (18) Virtual CD; (19) Cheetah CD and DVD Burner; (20) Mystik Media AudioEdit Deluxe, Blaze Media, and others; (21) Power Audio Editor; (22) DanDans Digital Media Full Audio Converter, Music Editing Master, and others; (23) Xrlly Software Text to Speech Makerand Arial Sound Recorder / Audio Converter; (24) Absolute Sound Recorder, Video to Audio Converter, and MP3 Splitter; (25) Easy Ringtone Maker; (26) RecordNRip; (27) McFunSoft iPod Audio Studio, Audio Recorder for Free, and others; (28) MP3 WAV Converter; (29) BearShare 6.0.2.26789; and (30) Oracle Siebel SimBuilder and CRM 7.x.

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Xwaver.com -> Magic music studio pro 
Xwaver.com -> Magic audio editor pro 
Xrlly software -> Arial audio converter 
Xrlly software -> Arial sound recorder 
Xrlly software -> Text to speech maker 
Virtual cd -> Virtual cd 
Virtual cd -> Virtual cd file server 
Softdiv softare -> Dexster 
Softdiv softare -> Ivideomax 
Softdiv softare -> Mp3 to wav converter 
Softdiv softare -> Snosh 
Softdiv softare -> Videozilla 
Smart media systems -> Power audio editor 
Sienzo -> Digital music mentor 
Roemer software -> Easy hi-q converter 
Roemer software -> Easy hi-q recorder 
Roemer software -> Free hi-q recorder 
Rmbsoft -> Audioconvert 
Rmbsoft -> Soundedit pro 
Recordnrip -> Recordnrip 
Quikscribe -> Quikscribe player 
Quikscribe -> Quikscribe recorder 
Nextlevel systems -> Audio editor gold 
Nextlevel systems -> Audio studio gold 
Nctsoft products -> Nctaudioeditor 
Nctsoft products -> Nctaudiofile2 
Nctsoft products -> Nctaudiostudio 
Nctsoft products -> Nctdialogicvoice 
Mystik media products -> Audioedit deluxe 
Mystik media products -> Blaze media pro 
Mystik media products -> Blaze mediaconvert 
Mystik media products -> Contextconvert pro 
Mp3-soft -> Mp3 normalizer 
Movavi -> Chiliburner 
Movavi -> Convertmovie 
Movavi -> Dvd to ipod 
Movavi -> Splitmovie 
Movavi -> Suite 
Movavi -> Videomessage 
Mediatox -> Aurora media workshop 
Mcfunsoft -> Audio editor 
Mcfunsoft -> Audio recorder for free 
Mcfunsoft -> Audio studio 
Mcfunsoft -> Ipod audio studio 
Mcfunsoft -> Ipod music converter 
Mcfunsoft -> Recording to ipod solution 
Magicvideosoftare -> Magic audio converter 
Magicvideosoftare -> Magic audio recorder 
Magicvideosoftare -> Magic music editor 
J hepple products -> Fx audio concat 
J hepple products -> Fx audio editor 
J hepple products -> Fx audio tools 
J hepple products -> Fx magic music 
J hepple products -> Fx movie joiner 
J hepple products -> Fx movie joiner and splitter 
J hepple products -> Fx movie splitter 
J hepple products -> Fx new sound 
J hepple products -> Fx video converter 
Joshua mediasoft -> Audio convertor plus 
Joshua mediasoft -> Video converter plus 
Imesh.com -> Imesh 
Iaudiosoft.com -> Absolute mp3 splitter 
Iaudiosoft.com -> Absolute sound recorder 
Iaudiosoft.com -> Absolute video to audio converter 
Expstudio -> Audio editor 
Easy ringtone maker -> Easy ringtone maker 
Digital borneo -> Audio mixer and editor 
Dandans digital media products -> Easy audio editor 
Dandans digital media products -> Full audio converter 
Dandans digital media products -> Music editing master 
Dandans digital media products -> Visual video converter 
Code-it softare -> Abasic editor 
Code-it softare -> Wave mp3 editor 
Cheetahburner -> Cheetah cd burner 
Cheetahburner -> Cheetah dvd burner 
Cdburnerxp -> Cdburnerxp pro 
Bearshare -> Bearshare 
Audio edit magic -> Audio edit magic 
Americanshareware -> Mp3 wav converter 
Altdo -> Convert mp3 master 
Altdo -> Mp3 record and edit audio master 

 References:
http://www.kb.cert.org/vuls/id/292713
http://www.securityfocus.com/archive/1/457936/100/200/threaded
http://www.securityfocus.com/archive/1/457940/100/200/threaded
http://www.securityfocus.com/archive/1/457965/100/200/threaded
http://www.securityfocus.com/bid/22196
http://www.securityfocus.com/bid/23892
http://www.vupen.com/english/advisories/2007/0310
https://exchange.xforce.ibmcloud.com/vulnerabilities/31707

Copyright 2020, cxsecurity.com

 

Back to Top