CVE-2008-4342 NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition,....
HighCVSS 9.3
EPSS 17.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| burnaware technologies burnaware | = 2.1.3-unknown | No fix listed |
| impressum cdburnerxp | = 4.2.1.976 | No fix listed |
| numedia soft numedia dvd burning sdk | = 1.008 | No fix listed |
References
- retrogod.altervista.org exploit
- 31936 third-party-advisory vendor-advisory
- 31949 third-party-advisory vendor-advisory
- 31950 third-party-advisory vendor-advisory
- 32455 third-party-advisory vendor-advisory
- 20081027 Blaze Media Pro 8.02 SE vulnerability mailing-list
- 31374 exploit vdb-entry
- www.shinnai.net exploit url-repurposed
- ADV-2008-2663 vdb-entry vendor-advisory
- nmsdvdburning-nmsdvdx-file-overwrite(45330) vdb-entry
- 6491 exploit