Lucene search

[email protected]CVE-2008-4771

HistoryOct 28, 2008 - 7:20 p.m.

CVE-2008-4771

2008-10-2819:20:14

CWE-119

[email protected]

web.nvd.nist.gov

cve-2008-4771

stack-based buffer overflow

vatdecoder.vatctrl.1

activex control

remote code execution

url property

security vulnerability

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.2 High

AI Score

Confidence

High

0.266 Low

EPSS

Percentile

96.8%

JSON

Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51), (2) D-Link MPEG4 SHM Audio Control (VAPGDecoder.dll 1.7.0.5), (3) Vivotek RTSP MPEG4 SP Control (RtspVapgDecoderNew.dll 2.0.0.39), and possibly other products, allows remote attackers to execute arbitrary code via a long Url property. NOTE: some of these details are obtained from third party information.

Affected configurations

NVD

Node

4xemvatctrl_classMatch1.0.0.27

4xemvatctrl_classMatch1.0.0.51

d-linkmpeg4_shm_audio_controlMatch1.7.0.5

vivotekrtsp_mpeg4_sp_controlMatch2.0.0.39

CPENameOperatorVersion
4xem:vatctrl_class4xem vatctrl classeq1.0.0.27
4xem:vatctrl_class4xem vatctrl classeq1.0.0.51
d-link:mpeg4_shm_audio_controld-link mpeg4 shm audio controleq1.7.0.5
vivotek:rtsp_mpeg4_sp_controlvivotek rtsp mpeg4 sp controleq2.0.0.39

CPE	Name	Operator	Version
4xem:vatctrl_class	4xem vatctrl class	eq	1.0.0.27
4xem:vatctrl_class	4xem vatctrl class	eq	1.0.0.51
d-link:mpeg4_shm_audio_control	d-link mpeg4 shm audio control	eq	1.7.0.5
vivotek:rtsp_mpeg4_sp_control	vivotek rtsp mpeg4 sp control	eq	2.0.0.39

References

osvdb.org/42378

osvdb.org/43007

secunia.com/advisories/29131

secunia.com/advisories/29145

secunia.com/advisories/29146

securityreason.com/securityalert/4517

www.securityfocus.com/bid/28010

www.vupen.com/english/advisories/2008/0685/references

www.vupen.com/english/advisories/2008/0686/references

www.vupen.com/english/advisories/2008/0687/references

exchange.xforce.ibmcloud.com/vulnerabilities/40863

exchange.xforce.ibmcloud.com/vulnerabilities/40864

exchange.xforce.ibmcloud.com/vulnerabilities/40867

www.exploit-db.com/exploits/5193

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.2 High

AI Score

Confidence

High

0.266 Low

EPSS

Percentile

96.8%

JSON

Related for CVE-2008-4771

prion1 nvd1 cvelist1