CVE-2008-4342

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 17%

exploitation probability

17%top 3% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/6491

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://retrogod.altervista.org/9sg_numedia_xpl.html http://secunia.com/advisories/31936 http://secunia.com/advisories/31949 http://secunia.com/advisories/31950 http://secunia.com/advisories/32455 https://exchange.xforce.ibmcloud.com/vulnerabilities/45330 https://www.exploit-db.com/exploits/6491 http://www.securityfocus.com/archive/1/497831/100/0/threaded http://www.securityfocus.com/bid/31374 http://www.shinnai.net/xplits/TXT_TrWE9AJA8nQpuFsnxBcq http://www.vupen.com/english/advisories/2008/2663