Signature Detail

HTTP: DX Studio Player Browser Plugin Remote Arbitrary Command Injection

This signature detects attempts to use unsafe ActiveX controls in DX Studio Player. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Worldweaver DX Studio Player is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data. Attackers can exploit this issue to execute arbitrary shell commands in the context of the vulnerable application. Versions prior to DX Studio Player 3.0.29.1 are vulnerable.

Affected Products

• Worldweaver DX Studio Player 3.0.12 0
• Worldweaver DX Studio Player 3.0.22 0
• Worldweaver DX Studio Player 3.0.29 0

References

• BugTraq: 35273
• CVE: CVE-2009-2011
• URL: http://osvdb.org/54969