CVE-2007-4983 Directory traversal vulnerability in the JetAudio.Interface.1 ActiveX control in JetFlExt.dll in jetAudio 7.0.3 Basic and 7.0.3.3016 allows remote attackers to create or overwrite arbitrary local file...
HighCVSS 10.0
EPSS 47.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the JetAudio.Interface.1 ActiveX control in JetFlExt.dll in jetAudio 7.0.3 Basic and 7.0.3.3016 allows remote attackers to create or overwrite arbitrary local files via a ..\ (dot dot backslash) in the second argument to the DownloadFromMusicStore method. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for code execution by overwriting JetAudio.exe, which is launched by the control after completion of the method call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cowon america jetaudio | = 7.0.3.3016 | No fix listed |
| cowon america jetaudio | = 7.0.3_basic | No fix listed |
References
- 37737 vdb-entry
- 26787 third-party-advisory vendor-advisory
- 25723 vdb-entry
- 1018716 vdb-entry
- ADV-2007-3196 vdb-entry
- jetaudio-downloadfrommusic-code-execution(36693) vdb-entry
- 4427 exploit