Secunia

A vulnerability has been reported in GraceNote CDDBControl ActiveX Control, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error within the handling of unspecified options that are passed to the ActiveX control. This can be exploited to cause a buffer overflow and may allow arbitrary code execution.

Successful exploitation requires that e.g. the user is tricked into visiting a malicious website.

The vulnerability has been reported in the ActiveX control distributed with the following products:
* Sony CONNECT Player
* Sony SonicStage version 3.3 and 3.4
* Sony SonicStage Mastering Studio version 2.1 and 2.2

Note: Other products that install the ActiveX control for CDDB CD information lookup may also be affected.

Solution
The vendor has issued a patch for the affected Sony products.
Further details available in Customer Area

Provided and/or discovered by
Discovered by Peter Vreugdenhil and reported via ZDI.

Original Advisory
Gracenote:
http://www.gracenote.com/corporate/FAQs.html/faqset=security/page=0

Zero Day Initiative:
http://www.zerodayinitiative.com/advisories/ZDI-06-019.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area