Gyu Tae Park has discovered a vulnerability in the iMBCContents ActiveX control, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the iMBCContents ActiveX control including the insecure "Execute()" method, which executes an arbitrary URI taken as argument. This can be exploited to execute arbitrary local programs with parameters on a user's system via a URI using the "file:" URI handler.

Successful exploitation requires that the user is e.g. tricked into visiting a malicious web site.

The vulnerability has been confirmed in version 2.0.0.55. Other versions may also be affected.

Solution
Update to version 2.0.0.59.

Provided and/or discovered by
Gyu Tae Park

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers