Pentest Limited has reported some vulnerabilities in Sony VAIO Media Integrated Server, which can be exploited by malicious people to gain knowledge of sensitive information or compromise a vulnerable system.

1) An unspecified boundary error can be exploited to cause a buffer overflow and execute arbitrary code with SYSTEM privileges.

2) An unspecified input validation error makes it possible to disclose the contents of arbitrary files on the system via directory traversal attacks.

Solution
Install VAIO Media Integrated Server 4.x/5.x Update Program 1.0.00.42120.

Provided and/or discovered by
Joe Moore, Pentest Limited.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Sony (Europe):
http://kb.sony-europe.com/kb/solutions/en/V00000_V00499/v00246.html

Sony (USA):
http://esupport.sony.com/perl/swu-download.pl?upd_id=2207&SMB=YES

Sony (Japan):
http://vcl.vaio.sony.co.jp/notices/security/info211.html

Sony (Asia):
http://www.css.ap.sony.com/VAIO/Website/General/ImportantNotices.aspx?Section=SN&file=/vaio/importantnotice/security_notice/SecurityNotice_VMIS.htm

Pentest Limited:
http://www.pentest.co.uk/documents/ptl-2006-02.html

Deep Links
Links available to Secunia VIM customers