Signature Detail

HTTP: NCTAudioFile2 ActiveX Vulnerability

This signature detects attempts to exploit a known vulnerability in NCTAudioFile2 ActiveX control. Attackers can create a malicious Web page containing dangerous Active X calls, which if accessed by a victim, can allow the attacker to gain control of the victim's client browser.

Extended Description

NCTsoft NCTAudioFile2 ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer. NCTAudioEditor is a collection of ActiveX controls for manipulating audio data. Numerous audio software products use the vulnerable 'NCTAudioFile2.AudioFile' ActiveX component. NCTAudioStudio 2.7.1, NCTAudioEditor 2.7.1, and NCTDialogicVoice 2.7.1 are affected by this vulnerability; other versions may be affected as well. NOTE: Please see the vulnerable systems section for third-party products that are affected because they depend on this ActiveX control.

Affected Products

• Absolute_software absolute_mp3_splitter 2
• Absolute_software absolute_sound_recorder 3
• Absolute_software absolute_video_to_audio_converter 2
• Absolute_software mp3_splitter 2.5.4
• Absolute_software sound_recorder 3.4.5
• Absolute_software video_to_audio_converter 2.7.9
• Akram_software akram_audio_converter 5
• Akram_software akram_audio_editor 2
• Akram_software akram_media_creator 1
• Alo_software alo_audio_editor 3.2
• Alo_software alo_rm_to_mp3_converter 7.0
• Altdo_software altdo_convert_mp3_master 1
• Altdo_software convert_mp3_master 1.1
• Altdo_software mp3_record&edit_audio_maste 1.2
• Altdo_software mp3_record&edit_audio_master 1
• American_shareware_technologies mp3_wav_converter 3
• Amw gold_wave_editor 9.9
• A-one_software dvd_creator 5.72
• A-one_software video_joiner 4.75
• A-one_software video_to_audio 4.42
• Arial audio_converter 2.3.40
• Arial sound_recorder 1.4.3
• Audioeditmagic audio_edit_magic 9.2.3
• Audioeditmagic audio_edit_magic 9.2.3 389
• Audiotool.net ease_mp3_recorder 1
• Audio_tools_factory vista_mp3_recorder 1.00
• Aurora_software aurora_media_workshop 3
• Aurora_software aurora_media_workshop 3.3.25
• Cheeta_technologies cd_burner 3
• Cheeta_technologies cd_burner 3.56
• Cheeta_technologies dvd_burner 1
• Cheeta_technologies dvd_burner 1.79
• Code-it_software abasic_editor 10
• Code-it_software abasic_editor 10.1
• Code-it_software rockn_audio 4
• Code-it_software wave_mp3_editor 10
• Color7_technology music_fan's_factory 9.2.23
• Color7_technology power_music_editor 7.4.0.10
• Colorfulsoft colorful_audio_recorder 2.0
• Colorfulsoft colorful_music_editor 2.0
• Cool_audio_software magic_audio_editor_pro 10
• Cool_audio_software magic_music_studio_pro 7
• Dandans_digital_media easy_audio_editor 7
• Dandans_digital_media full_audio_converter 4
• Dandans_digital_media music_editing_master 5
• Dandans_digital_media visual_video_converter 4
• Digital_borneo db_audio_mixer_and_editor 1
• Digital_borneo db_audio_mixer_and_editor 1.1.0
• Digital_smart audio_convert_master 7.4.0.10
• Digital_smart digital_audio_cd_burner 7.4.0.10
• Digital_smart digital_audio_editor 7.4.0.10
• Digital_smart digital_music_digital_edit_burn_studio 8.0.4.1
• Digital_smart digital_music_record_convert_burn_station 7.4.3.15
• Easy_ringtone_maker easy_ringtone_maker 2
• Expstudio audio_editor 4
• Focus_systems focus_all_cd/dvd_burner 2.1.0.1
• Focus_systems focus_audio_converter 3.2
• Focus_systems focus_mp3_recorder_pro 3.4
• Focus_systems focus_mp3_recorder_splitter 3.4
• Goodvdsoft.com easy_dvd_converter 1.00
• Goodvdsoft.com goo_dvd_to_audio_converter 1.00
• Goodvdsoft.com goo_dvd_to_mp3_converter 1.00
• Goodvdsoft.com goo_dvd_to_mpeg_converter 1.00
• Goodvdsoft.com goo_dvd_to_ogg_converter 1.00
• Goodvdsoft.com goo_dvd_to_rm_converter 1.00
• Goodvdsoft.com goo_dvd_to_video_converter 1.00
• Goodvdsoft.com goo_dvd_to_wav_converter 1.00
• Goodvdsoft.com goo_dvd_to_wma_converter 1.00
• Goodvdsoft.com goo_dvd_to_wmv_converter 1.00
• H+h_software virtual_cd 6
• H+h_software virtual_cd 7
• H+h_software virtual_cd 8
• H+h_software virtual_cd_file_server 7
• Hifi_software cd_to_mp3_rm_ripper 1.70
• Hifi_software hifi_mp3_recorder_joiner 2.00
• Hifi_software hifi_ogg_splitter_joiner 3.00
• Hifi_software hifi_wav_splitter_joiner 3.00
• Hifi_software hifi_wma_recorder_joiner 2.00
• Hifi_software hifi_wma_splitter_joiner 3.00
• Hifi_software mp3_audio_recorder_joiner 2.11
• Hifi_software mp3_audio_splitter_joiner 3.00
• Hifi_software mp3_wma_cutter 2.00
• Hifi_software rm_audio_converter 2.70
• Hifi_software rm_mp3_converter 2.70
• Hifi_software rm_ogg_converter 2.70
• Hifi_software rm_wav_converter 2.70
• Hifi_software rm_wma_converter 2.70
• Hit-recorder hit-recorder 1.7.0 0
• Hit-recorder hit-recorder 2.2.3 7
• Imesh imesh 7
• J._hepple fx_audio_editor 4
• J._hepple fx_audio_tools 7
• J._hepple fx_concat_audio_joiner 1
• J._hepple fx_joiner_and_splitter 6
• J._hepple fx_magic_music 5
• J._hepple fx_movie_joiner 6
• J._hepple fx_movie_splitter 6
• J._hepple fx_new_sound 5
• J._hepple fx_video_converter 7
• Joshua_mediasoft audio_converter_plus 2.2
• Joshua_mediasoft video_converter_plus 3.01
• Magic_software magic_rm_avi_mpeg_to_mp3_converter_&_editor 2
• Magic_video_software magic_audio_converter 8
• Magic_video_software magic_audio_recorder 5
• Magic_video_software magic_music_editor 5
• Mcfunsoft audio_editor 6
• Mcfunsoft audio_recorder_for_free 6
• Mcfunsoft audio_studio 6
• Mcfunsoft ipod_audio_studio 6
• Mcfunsoft ipod_music_converter 5
• Mcfunsoft recording_to_ipod_solution 5
• Mightsoft audio_editor_pro 2
• Mightsoft ez_audio_server 2
• Movavi chiliburner 2
• Movavi convertmovie 3
• Movavi convertmovie 4
• Movavi dvd_to_ipod 1
• Movavi splitmovie 1
• Movavi videomessage 1
• Movavi videosuite 3
• Mp3-soft mp3_normalizer 1.03
• Musiclab bearshare 6.0.2.26789
• Mystik_media audioedit_deluxe 3
• Mystik_media audioedit_deluxe 4
• Mystik_media audioedit_deluxe 4.10
• Mystik_media blaze_media_convert 3
• Mystik_media blaze_media_convert 3.4
• Mystik_media blaze_media_pro 6
• Mystik_media blaze_media_pro 7
• Mystik_media context_convert_pro 3
• Mystik_media contextconvert_pro 3.1
• Nctsoft nctaudioeditor_activex_dll 2
• Nctsoft nctaudiostudio_activex_dll 2
• Nctsoft nctdialogicvoice_activex_dll 2
• Nextlevel_software audio_editor_gold 0.2.5 Build 424
• Nextlevel_software audio_editor_gold 9
• Nextlevel_software audio_studio_gold 7
• Oracle siebel_simbuilder 7.8.5 build 2635
• Plato_software dvd_creator 3.7
• Plato_software video_joiner 4.57
• Quikscribe player 5
• Quikscribe recorder 5
• Recordnrip recordnrip 1
• Rmbsoft audioconvert 3.1.0.125
• Rmbsoft audio_converter 3
• Roemer_software easy_hi-q_converter 1.7
• Roemer_software easy_hi-q_recorder 2.0
• Roemer_software free_hi-q_recorder 1.9
• Sienzo digital_music_mentor 2
• Smartmedia_systems power_audio_editor 11
• Softdiv dexster_audio_editor 3
• Softdiv ivideomax 3
• Softdiv mp3_to_wav_converter 3
• Softdiv snosh 1
• Softdiv videozilla 2
• Stefan_bethge cdburnerxp_pro 3.0.116
• Stefan_haglund,_fredrik_haglund,_florian_schmitz cdburner_xp_pro 2
• Stefan_haglund,_fredrik_haglund,_florian_schmitz cdburner_xp_pro 3
• Tec_software tec_sound_recorder 1.0
• Xrlly_software arial_audio_converter 2
• Xrlly_software arial_sound_recorder 1
• Xrlly_software text_to_speech_maker 1

References

• BugTraq: 22196
• CVE: CVE-2007-0018
• URL: http://www.securityfocus.com/archive/1/457965/30/0/threaded
• URL: http://www.kb.cert.org/vuls/id/292713