1. Symantec/
  2. Security Response/
  3. Attack Signatures/
  4. HTTP NCTAudioFile2 ActiveX BO

HTTP NCTAudioFile2 ActiveX BO

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Description

This signature detects attempt to exploit a buffer overflow vulnerability in NCTAudioEditor ActiveX Control.

Additional Information

NCTAudioEditor ActiveX DLL is a collection of ActiveX components for building end-user audio data applications. Numerous third-party audio applications use it as an interface to edit, display, mix, and convert audio files.

NCTAudioFile2 ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer.

Specifically, this issue is due to a boundary condition in the 'SetFormatLikeSample()' method in the 'NCTAudioFile2.AudioFile' ActiveX component. By passing an inordinately long string of approximately 4124 bytes as input to the affected method, an attacker can trigger a stack-based buffer overflow.

Invoking the object from a malicious website or HTML email may trigger the condition. A successful attack would corrupt process memory, resulting in arbitrary code execution in the context of the client application using the affected ActiveX control.

NCTAudioStudio 2.7.1, NCTAudioEditor 2.7.1, and NCTDialogicVoice 2.7.1 are affected by this vulnerability; other versions may be affected as well.

NCTAudioEditor is a collection of ActiveX controls commonly used by third-party applications. Numerous audio software products use the vulnerable 'NCTAudioFile2.AudioFile' ActiveX component.

Please see the list of associated technologies for a table of third-party products that are vulnerable because they depend on this ActiveX control.

Affected

  • Absolute Software Absolute MP3 Splitter 2
  • Absolute Software Absolute Sound Recorder 3
  • Absolute Software Absolute Video to Audio Converter 2
  • Absolute Software MP3 Splitter 2.5.4
  • Absolute Software Sound Recorder 3.4.5
  • Absolute Software Video to Audio Converter 2.7.9
  • Altdo Software Altdo Convert Mp3 Master 1
  • Altdo Software Convert Mp3 Master 1.1
  • Altdo Software Mp3 Record&Edit Audio Maste 1.2
  • Altdo Software Mp3 Record&Edit Audio Master 1
  • American Shareware Technologies MP3 WAV Converter 3
  • Arial Audio Converter 2.3.40
  • Arial Sound Recorder 1.4.3
  • AudioEditMagic Audio Edit Magic 9.2.3 389, 9.2.3
  • Aurora Software Aurora Media Workshop 3, 3.3.25
  • Cheetah Website Corporation CD Burner 3, 3.56
  • Cheetah Website Corporation DVD Burner 1, 1.79
  • Code-it Software aBasic Editor 10, 10.1
  • Code-it Software Wave MP3 Editor 10
  • Cool Audio Software Magic Audio Editor Pro 10
  • Cool Audio Software Magic Music Studio Pro 7
  • DanDans Digital Media Easy Audio Editor 7
  • DanDans Digital Media Full Audio Converter 4
  • DanDans Digital Media Music Editing Master 5
  • DanDans Digital Media Visual Video Converter 4
  • Digital Borneo DB Audio Mixer and Editor 1, 1.1
  • Easy Ringtone Maker Easy Ringtone Maker 2
  • EXPStudio Audio Editor 4
  • H+H Software Virtual CD 6, 7, 8
  • H+H Software Virtual CD File Server 7
  • iMesh iMesh 7
  • J. Hepple FX Audio Editor 4
  • J. Hepple FX Audio Tools 7
  • J. Hepple FX ConCat Audio Joiner 1
  • J. Hepple FX Joiner and Splitter 6
  • J. Hepple FX Magic Music 5
  • J. Hepple FX Movie Joiner 6
  • J. Hepple FX Movie Splitter 6
  • J. Hepple FX New Sound 5
  • J. Hepple FX Video Converter 7
  • Joshua Mediasoft Audio Converter Plus 2.2
  • Joshua Mediasoft Video Converter Plus 3.01
  • Magic Video Software Magic Audio Converter 8
  • Magic Video Software Magic Audio Recorder 5
  • Magic Video Software Magic Music Editor 5
  • McFunSoft Audio Editor 6
  • McFunSoft Audio Recorder for Free 6
  • McFunSoft Audio Studio 6
  • McFunSoft iPod Audio Studio 6
  • McFunSoft iPod Music Converter 5
  • McFunSoft Recording to iPod Solution 5
  • Movavi ChiliBurner 2
  • Movavi ConvertMovie 3, 4
  • Movavi DVD to iPod 1
  • Movavi Splitmovie 1
  • Movavi VideoMessage 1
  • Movavi VideoSuite 3
  • MP3-Soft MP3 Normalizer 1.03
  • Musiclab BearShare 6.0.2
  • Mystik Media AudioEdit Deluxe 3, 4, 4.10
  • Mystik Media Blaze Media Convert 3, 3.4
  • Mystik Media Blaze Media Pro 6, 7
  • Mystik Media Context Convert Pro 3
  • Mystik Media ContextConvert Pro 3.1
  • NCTsoft NCTAudioEditor ActiveX DLL 2
  • NCTsoft NCTAudioStudio ActiveX DLL 2
  • NCTsoft NCTDialogicVoice ActiveX DLL 2
  • NextLevel Software Audio Editor Gold 0.2.5 Build 424, 9
  • NextLevel Software Audio Studio Gold 7
  • Quikscribe Player 5
  • Quikscribe Recorder 5
  • Recordnrip RecordNRip 1
  • RMBSoft Audio Converter 3
  • RMBSoft AudioConvert 3.1.0.125
  • Roemer Software Easy Hi-Q Converter 1.7
  • Roemer Software Easy Hi-Q Recorder 2.0
  • Roemer Software Free Hi-Q Recorder 1.9
  • Sienzo Digital Music Mentor 2
  • SmartMedia Systems Power Audio Editor 11
  • SoftDiv Dexster Audio Editor 3
  • SoftDiv iVideoMAX 3
  • SoftDiv MP3 to WAV Converter 3
  • SoftDiv Snosh 1
  • SoftDiv VIDEOzilla 2
  • Stefan Bethge CDBurnerXP Pro 3.0.116
  • Stefan Haglund, Fredrik Haglund, Florian Schmitz CDBurner XP Pro 2, 3
  • Xrlly Software Arial Audio Converter 2
  • Xrlly Software Arial Sound Recorder 1
  • Xrlly Software Text to Speech Maker 1

Response

Ensure that all patches and updates for affected products have been applied.

Additional References

  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube