CVE-2008-4342

CVSS V2 High 9.3 CVSS V3 None
Description
NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.
Overview
  • CVE ID
  • CVE-2008-4342
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2008-09-30T17:22:09
  • Last Modified Date
  • 2018-10-11T20:51:40
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:burnaware_technologies:burnaware:2.1.3:unknown:free:*:*:*:*:* 1 OR
cpe:2.3:a:burnaware_technologies:burnaware:2.1.3:unknown:home:*:*:*:*:* 1 OR
cpe:2.3:a:burnaware_technologies:burnaware:2.1.3:unknown:professional:*:*:*:*:* 1 OR
cpe:2.3:a:impressum:cdburnerxp:4.2.1.976:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:numedia_soft:numedia_dvd_burning_sdk:1.008:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 9.3
  • Severity
  • HIGH
  • Exploitability Score
  • 8.6
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://secunia.com/advisories/31950 Vendor Advisory
http://retrogod.altervista.org/9sg_numedia_xpl.html Exploit
http://www.securityfocus.com/bid/31374 Exploit
http://www.shinnai.net/xplits/TXT_TrWE9AJA8nQpuFsnxBcq Exploit
http://secunia.com/advisories/31936 Vendor Advisory
http://secunia.com/advisories/31949 Vendor Advisory
http://secunia.com/advisories/32455 Vendor Advisory
http://www.vupen.com/english/advisories/2008/2663 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45330
https://www.exploit-db.com/exploits/6491
http://www.securityfocus.com/archive/1/497831/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2008-4342
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4342
History
Created Old Value New Value Data Type Notes
2022-05-10 18:27:49 Added to TrackCVE