|
Move Networks Media Player QMPUpgrade.dll ActiveX Control Buffer Overflow Vulnerability
The Move Networks Media Player ActiveX control that is used to manage updates is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions. This issue affects Move Media Player 1.0.0.1; other versions may also be vulnerable. UPDATE (January 28, 2008): Reports indicate that recent versions of the affected application are not vulnerable because the 'QMPUpgrade.dll' is no longer included. However, users who upgraded to a newer version from a vulnerable version may still be affected because the installation process of newer versions leaves the vulnerable library intact. Please see the workaround section for information on how to address this. |
|
|
Privacy Statement |
