Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
Ask the Team  Mailing Lists  Advertising Info  Advisories  About SecuriTeam  Blogs Brought to you by: Suppliers of: Website Testing Tools Network Testing Tools Software Testing Tools SecuriTeam in Your Inbox New vulnerability? New tool? Tell us (Our PGP key).	SlySoft Multiple Products ElbyCDIO.sys Denial of Service 16 Mar. 2009    Summary SlySoft AnyDVD is "capable of removing unwanted movie features, including subtitles and prohibition messages such as copyright and FBI warnings. It also allows you to launch an external application whenever you insert or remove a disc, or prevent 'PC-friendly' software from automatically launching when you insert a video DVD". Positive Technologies Research Team has discovered multiple memory corruption vulnerabilities in SlySoft products.   Credit: The information has been provided by Valery Marchuk. The original article can be found at: http://en.securitylab.ru/lab/PT-2009-11 Website Security Scan Code Vulnerability Test Network Assessment Tool Detect hidden vulnerabilities Exhaustive automated testing Real-time, continuous security Get guidance from professionals of internal or 3rd party code. scanning for your entire network    Details Protect your website! Use an External Vulnerability Scanner! Nothing to install. First report in 1 hour! www.beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * AnyDVD version 6.5.2.2 and previous  * Virtual CloneDrive version 5.4.2.3 and previous  * CloneDVD version 2.9.2.0 and previous  * CloneCD version 5.3.1.3 and previous Immune Systems:  * AnyDVD version 6.5.2.6 The IOCTL handler in ElbyCDIO.sys 6.0.2.0 and earlier, shipped with AnyDVD, Virtual CloneDrive, CloneDVD and CloneCD, uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate buffer data associated with the Irp object, which allows local users to crash the system. Disclosure Timeline: 02.11.2009 - Vendor notified 02.11.2009 - Vendor replied 02.12.2009 - Sent detailed information 03.06.2009 - Vendor released fixed version of AnyDVD 03.12.2009 - Public disclosure  Comments:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles SAP MaxDB Malformed Handshake Request Remote Code Execution Vulnerability Dojo Toolkit SDK Multiple DOM-Based XSS Vulnerabilities Microsoft Indeo Codec Memory Corruption Vulnerability HP DDMI Execution of Arbitrary Code Microsoft Windows License Logging Service Heap Corruption Vulnerability Microsoft Office Excel Code Execution Vulnerabilities Microsoft SharePoint 2007 ASP.NET Source Code Disclosure Microsoft Windows Local Security Authority Integer Overflow Vulnerability Windows Kernel Multiple Vulnerabilities Microsoft Windows ActiveX Indexing Service Memory Corruption Vulnerability Microsoft IIS FTP Service Code Execution and DoS Vulnerability Microsoft GDI+ Multiple Vulnerabilities Microsoft .NET Common Language Runtime Multiple Vulnereabilities Microsoft Active Template Library ActiveX Controls Multiple Vulnerabilities ActiveX Active Template Library Initialization Vulnerability  Featured Articles Microsoft Embedded OpenType Font Engine Heap Buffer Overflow (MS09-029) Virtualmin Multiple Vulnerabilities Microsoft WordPad Word97 Converter Stack Buffer Overflow Vulnerability (MS09-010) WordPress Unchecked Privileges in admin.php and Multiple Information Disclosures Microsoft PowerPoint Conversion Filter Heap Corruption Vulnerability (MS09-017) Adobe Shockwave Player Director File Parsing Pointer Overwrite Mozilla Firefox Java Applet Loading Vulnerability
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2010 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®